SAP fixes four unauthenticated NetWeaver and Web Dispatcher flaws rated CVSS 10.0, including two that could allow remote code execution.