Security Digest: November 10, 2026 - 65 Critical Vulnerabilities

Today’s threat picture is severe: multiple critical SAP flaws, several authentication-bypass issues, and a wide spread of remote code execution bugs across enterprise software, web apps, and network appliances. The most urgent risks are unauthenticated SAP exposure, hardcoded secrets, and admin-session hijacking paths that can lead to full system compromise.

· 15 min read

Executive Summary

Today’s threat picture is severe: multiple critical SAP flaws, several authentication-bypass issues, and a wide spread of remote code execution bugs across enterprise software, web apps, and network appliances. The most urgent risks are unauthenticated SAP exposure, hardcoded secrets, and admin-session hijacking paths that can lead to full system compromise.

Act now: prioritize internet-facing SAP systems, disable or restrict exposed management services, and fast-track vendor patches for any affected platform. If you cannot patch immediately, isolate the service, block untrusted network access, and increase logging for authentication and admin actions.

Critical Vulnerabilities

  • CVE-2026-89103: SAP Gateway ACL privilege exposure
    • Impact: Unauthenticated attackers may act with internal trust and perform unauthorized actions.
    • Affected Systems: SAP Gateway.
    • Immediate Action: Restrict network access to the Gateway now and apply the vendor fix as soon as available.
    • Mitigation: Remove public exposure, segment SAP traffic, and review trust relationships.
  • CVE-2026-120017: SAP NetWeaver ABAP authentication bypass
    • Impact: Attackers can impersonate users, including privileged accounts.
    • Affected Systems: SAP NetWeaver AS ABAP, ABAP Platform.
    • Immediate Action: Patch immediately and audit for unexpected logins.
    • Mitigation: Tighten auth assertion handling and restrict external access.
  • CVE-2026-89126: SAP Web Dispatcher memory corruption
    • Impact: Remote code execution and full compromise.
    • Affected Systems: SAP Web Dispatcher.
    • Immediate Action: Isolate the dispatcher and apply the patch.
    • Mitigation: Block untrusted network traffic and monitor for crashes.
  • CVE-2026-124600: GV-Face credential exposure over HTTP
    • Impact: Credentials can be intercepted in transit.
    • Affected Systems: GV-Face.
    • Immediate Action: Disable HTTP access and force secure transport.
    • Mitigation: Rotate exposed credentials and enforce TLS.
  • CVE-2026-76964: SAP NetWeaver ABAP memory corruption
    • Impact: Remote code execution.
    • Affected Systems: SAP NetWeaver Application Server ABAP.
    • Immediate Action: Patch urgently and limit inbound traffic.
    • Mitigation: Watch for malformed requests and process crashes.
  • CVE-2026-109803: SAP NetWeaver KM XSL transformation abuse
    • Impact: Authenticated attackers may execute code.
    • Affected Systems: SAP NetWeaver Knowledge Management (XML Forms).
    • Immediate Action: Restrict access to trusted users only.
    • Mitigation: Apply updates and review transformation sources.
  • CVE-2026-13312: System compromise vulnerability
    • Impact: System compromise.
    • Affected Systems: Not specified.
    • Immediate Action: Identify the affected product in your environment and check for patches.
    • Mitigation: Follow vendor guidance immediately.
  • CVE-2026-76965: SAP ABAP internal function authorization flaw
    • Impact: Low-privilege attackers can run OS commands.
    • Affected Systems: SAP NetWeaver AS ABAP, ABAP Platform.
    • Immediate Action: Patch and limit low-privilege access.
    • Mitigation: Review internal function exposure and authorization rules.
  • CVE-2026-109795: SAP NetWeaver remote code injection
    • Impact: Arbitrary code execution.
    • Affected Systems: SAP NetWeaver.
    • Immediate Action: Patch immediately.
    • Mitigation: Restrict remote interfaces and validate inputs.
  • CVE-2026-115646: HiRDB partial string comparison
    • Impact: Potential security bypass or unauthorized access.
    • Affected Systems: HiRDB Server 9/10 and related additional-function builds.
    • Immediate Action: Upgrade to fixed versions now.
    • Mitigation: Confirm deployed build numbers and apply vendor updates.
  • CVE-2026-89119: SAP Web Dispatcher / ICM admin-session abuse
    • Impact: Malicious links can trigger unintended admin actions and lead to OS compromise.
    • Affected Systems: SAP Web Dispatcher, SAP NetWeaver AS ABAP ICM.
    • Immediate Action: Warn administrators and patch immediately.
    • Mitigation: Use least privilege and harden admin workflows.
  • CVE-2026-125370: Kubero JWT forgery
    • Impact: Admin takeover of pipelines, apps, users, and tokens.
    • Affected Systems: Kubero 3.0.0 through 3.1.1.
    • Immediate Action: Set a strong JWT secret and upgrade.
    • Mitigation: Rotate all tokens and verify JWT_SECRET is configured.
  • CVE-2026-125086: D-Link M60 hardcoded credentials
    • Impact: Remote attackers may gain privileged access.
    • Affected Systems: D-Link M60 1.12.B01.
    • Immediate Action: Remove internet exposure and replace credentials immediately.
    • Mitigation: Apply any firmware fix and audit MQTT access.
  • CVE-2026-125383: INDOTALENT WHMS JWT key weakness
    • Impact: Forged tokens allow full admin access.
    • Affected Systems: INDOTALENT WHMS before 10.20261109.
    • Immediate Action: Upgrade and rotate signing material.
    • Mitigation: Treat all existing tokens as untrusted.
  • CVE-2026-125384: INDOTALENT WHMS default admin credentials
    • Impact: Unauthenticated admin access.
    • Affected Systems: INDOTALENT WHMS before 10.20261109.
    • Immediate Action: Change default credentials or take systems offline until patched.
    • Mitigation: Remove exposed default accounts and force password resets.
  • CVE-2026-107246: Plesk Site Import path traversal
    • Impact: Root code execution.
    • Affected Systems: Plesk extension Site Import before 1.13.2.
    • Immediate Action: Update the extension immediately.
    • Mitigation: Restrict subscription-user access and review filesystem permissions.
  • CVE-2026-109798: SAP BusinessObjects XXE
    • Impact: Read sensitive files and reach internal systems.
    • Affected Systems: SAP BusinessObjects BI Platform Web Intelligence.
    • Immediate Action: Patch and restrict OLAP connection requests.
    • Mitigation: Disable external entity resolution where possible.
  • CVE-2026-125612: Deltaww DIAEnergie SQL injection
    • Impact: Database compromise and data theft.
    • Affected Systems: DIAEnergie before 1.11.01.032.
    • Immediate Action: Upgrade immediately.
    • Mitigation: Review exposed SQL endpoints and database permissions.
  • CVE-2026-4762: privilege escalation on server
    • Impact: Non-admin users can escalate privileges.
    • Affected Systems: Not specified.
    • Immediate Action: Identify the product and apply the vendor fix.
    • Mitigation: Review local privilege boundaries.
  • CVE-2026-125364: frab orga-role escalation
    • Impact: Crew users can grant themselves organizer rights.
    • Affected Systems: frab through 0.9.1.
    • Immediate Action: Patch and audit all orga roles.
    • Mitigation: Review user update paths and role assignment logs.
  • CVE-2026-60039: backup restore code injection
    • Impact: Code execution with high privileges.
    • Affected Systems: Backup restore function in affected product.
    • Immediate Action: Disable restore access until patched.
    • Mitigation: Restrict restore operations to trusted admins only.
  • CVE-2026-125360: Storyden role escalation
    • Impact: Users can assign themselves administrator permission.
    • Affected Systems: Storyden through 1.26.16.
    • Immediate Action: Upgrade and review role changes.
    • Mitigation: Lock down MANAGE_ROLES permissions.
  • CVE-2026-125399: Fluxion command injection
    • Impact: Root command execution from a crafted Wi-Fi SSID.
    • Affected Systems: Fluxion before 6.39.
    • Immediate Action: Stop using affected versions in production workflows.
    • Mitigation: Patch and avoid scanning untrusted AP names.
  • CVE-2026-125382: Map-OS user API privilege escalation
    • Impact: Attackers can assign admin group, reset super admin passwords, or delete users.
    • Affected Systems: Map-OS 5.0.0 through before 5.2.2.
    • Immediate Action: Update immediately.
    • Mitigation: Recheck API authorization on all user-management routes.
  • CVE-2026-125396: Ghostscript -dSAFER bypass
    • Impact: Crafted documents can lead to arbitrary code execution.
    • Affected Systems: Ghostscript before 10.08.0.
    • Immediate Action: Upgrade Ghostscript immediately.
    • Mitigation: Treat untrusted PDFs and PostScript as high risk.
  • CVE-2026-12389: high-privileged authenticated RCE
    • Impact: Privileged user can execute code remotely.
    • Affected Systems: Not specified.
    • Immediate Action: Search for the affected product and patch.
    • Mitigation: Reduce privileged account exposure.
  • CVE-2026-63288: WebSocket auth bypass
    • Impact: Unauthorized access to a separate API endpoint.
    • Affected Systems: Not specified.
    • Immediate Action: Restrict the endpoint and patch.
    • Mitigation: Verify authentication on all WebSocket paths.
  • CVE-2026-91763 / CVE-2026-91761 / CVE-2026-91764 / CVE-2026-91762 / CVE-2026-91759 / CVE-2026-91758 / CVE-2026-91760: Hitachi Dynamic Link Manager for Linux flaws
    • Impact: Symlink following, improper link resolution, and buffer overflows may expose data, corrupt memory, or enable code execution.
    • Affected Systems: Hitachi Dynamic Link Manager for Linux across multiple releases before 9.0.5-00.
    • Immediate Action: Upgrade all affected installations to 9.0.5-00 or later.
    • Mitigation: Audit storage hosts and isolate management access until updated.

What to Do Now

  1. Patch SAP first. Prioritize internet-facing SAP Gateway, Web Dispatcher, NetWeaver ABAP, and BusinessObjects systems.
  2. Disable exposed management services. Shut down unused Node.js web services, provisioning portals, and admin endpoints.
  3. Rotate secrets and credentials. Replace hardcoded, default, or exposed JWT keys, API keys, and admin passwords.
  4. Restrict access. Limit SAP and appliance management interfaces to trusted networks only.
  5. Verify versions. Confirm affected builds against vendor advisories and upgrade to fixed releases.

Verification steps: inventory exposed services, check exact version numbers, review authentication logs for new admin sessions, and search for unexpected role changes, token forgery, or repeated request failures.

Monitoring recommendations: watch for SAP process crashes, unusual login patterns, admin links clicked from email or chat, suspicious file deletions, and spikes in 4xx/5xx errors on Web Dispatchers, APIs, and provisioning services.

Related Resources

  • Internal: link to your internal blog post on emergency patching and SAP exposure once published.
  • Official vendor advisories: SAP Security Notes, Hitachi support advisories, Plesk extension updates, WordPress plugin changelogs, Ghostscript release notes, and vendor firmware/security bulletins for D-Link, Versa, and HiRDB.

Keep reading