SAP patches four 10.0 flaws in NetWeaver, Gateway and Web Dispatcher
The fixes cover ICM2SHELL and PROXYGATE, reported by Onapsis, which says no in-the-wild exploitation has been observed but a working exploit exists.
SAP's Tuesday security update for November 2026 fixes four vulnerabilities scored 10.0 on the CVSS scale: CVE-2026-76964, CVE-2026-89126, CVE-2026-89103 and CVE-2026-120017. SAP says unauthenticated attackers can exploit any of the four to fully compromise affected systems remotely. The vendor published 35 security notes, including nine rated Critical and 17 High.
Onapsis found and reported three of the four and groups them under two names. ICM2SHELL comprises CVE-2026-76964 in the Internet Communication Manager of NetWeaver AS ABAP and CVE-2026-89126 in SAP Web Dispatcher. PROXYGATE is CVE-2026-89103 in SAP Gateway. The remaining maximum-severity issue, CVE-2026-120017, stems from missing authentication in the SAML2 Service Provider component of NetWeaver AS ABAP and ABAP Platform.
ICM2SHELL sits in shared SAP Kernel code that reassembles fragmented WebSocket messages, used by both the ICM and Web Dispatcher. Onapsis states that exploitation requires no credentials, user interaction, or misconfiguration, as WebSocket support is turned on by default and certain standard S/4HANA services permit unauthenticated WebSocket connections. Successful exploitation can execute code as the system's administrator account or crash the affected component. The flaw affects systems running SAP Kernel 7.40 or newer, which includes the Web Dispatcher built into SAP HANA XS; deployments that are Java-only are not at risk.
PROXYGATE makes SAP Gateway treat an unauthenticated external attacker as one of its internal application servers, which lets the attacker run operating system commands. Onapsis says the kernel patch alone does not stop PROXYGATE. Administrators also need to restrict the gateway proxy access list or configure the new gw/acl_mode_proxy parameter, since the out-of-the-box setting permits every connection. A number of kernel versions that are out of maintenance are vulnerable and require an upgrade instead of a patch.
As of Tuesday, Onapsis said it had not seen any real-world attacks on the flaws it reported, but it has created a functional end-to-end exploit for ICM2SHELL. BleepingComputer points out that CISA has listed 14 SAP vulnerabilities in its Known Exploited Vulnerabilities catalog since November 2021, and in August a maximum-severity bug in SAP Commerce Cloud was attacked within days of being fixed.
Administrators should apply the November security notes immediately; for PROXYGATE also tighten the gateway proxy access list or set gw/acl_mode_proxy, and upgrade out-of-maintenance kernels rather than trying to patch them.
Sources: BleepingComputer, MLQ.ai
Lena Vasquez covers vulnerabilities, breaches and identity for Five Nines. She writes from advisories, vendor bulletins and published reporting.
Corrections. Report an error to corrections@thefivenines.com. We list substantive corrections on the corrections page.