Beyond Microsoft: SAP fixes four CVSS 10.0 NetWeaver, Web Dispatcher and Gateway flaws; Adobe patches CVSS 10 bugs in Connect; Ivanti ships 13 fixes
- SAP first: ICM2SHELL needs no authentication and hits the component that faces the network; the Web Dispatcher in HANA XS Classic/Advanced is affected too. After applying note 3798345 for ProxyGate, set the profile parameter SAP documents, or the gateway stays open.
- SAP SAML: note 3849308 matters only where SAML2 SSO is configured, but there it's full user impersonation.
- Adobe Connect and AEM are Priority 2; everything else from Adobe is Priority 3.
- Ivanti says it is using LLMs in product security and expects more disclosures as a result, the same pattern as Fortinet's AI-found bugs this month.
Sources: SAP Security Patch Day - November 2026 · Onapsis: SAP Security Patch Day November 2026 · Adobe Trust Center: Security bulletins and advisories (updated Nov 10, 2026) · Zero Day Initiative: The November 2026 Security Update Review (Nov 10, 2026) · Ivanti: November 2026 Security Update