Ing. Calogero Bono
On November 10, 2026, SAP published its monthly Security Patch Day, with four vulnerabilities rated 10 out of 10 on the CVSS scale. They affect NetWeaver Application Server ABAP, Web Dispatcher and Gateway, components at the heart of many enterprise systems. According to SAP, an attacker without credentials can exploit them remotely and compromise the system. It matters because two of the flaws allow code execution and none requires any action from the user.
A few terms before we get into the facts. CVSS is the 0 to 10 scale that measures how severe a flaw is. NetWeaver is the platform on which SAP applications run. Web Dispatcher receives web requests and forwards them to the server, acting as a load balancer and reverse proxy. ICM (Internet Communication Manager) handles the server's web traffic. SAML enables single sign-on by delegating login to an identity provider.
What did SAP fix in November?
The bulletin from the National Cybersecurity Agency reports 42 new vulnerabilities, of which 9 critical and 19 high. BleepingComputer counts 35 in the month's updates. The sources do not explain the difference in counts.
The four 10-rated flaws are CVE-2026-76964 (ICM), CVE-2026-89126 (Web Dispatcher), CVE-2026-89103 (Gateway) and CVE-2026-120017 (SAML2 provider). Each has its own SAP note, with different affected versions.
What are ICM2SHELL and PROXYGATE?
These are the names given by Onapsis, the company that found three of the flaws. ICM2SHELL refers to CVE-2026-76964 and CVE-2026-89126, which stem from the same error in the kernel code used to reassemble split WebSocket messages. According to The Hacker News, Onapsis provided SAP with a working exploit that runs operating system commands as <sid>adm.
The same error can crash ICM or Web Dispatcher. If Web Dispatcher goes down, all the SAP systems behind it are isolated. WebSocket support is enabled by default, so you are exposed even without using it.
How do the Gateway and SAML flaws work?
PROXYGATE is CVE-2026-89103. It makes the Gateway believe an external attacker is one of the internal application servers. Onapsis explains that exposure depends on the prxyinfo proxy list, or on the gw/acl_mode_proxy parameter if the list is missing, and not on the secinfo and reginfo lists that most guides cite.
The SAML flaw (CVE-2026-120017) concerns the missing verification of signatures on assertions in certain configurations. According to the vendor, it allows access as any user, including privileged ones, on some systems using SAML single sign-on.
Are these flaws already being exploited?
For now the sources report no attacks. Onapsis researchers state they have not seen ICM2SHELL or PROXYGATE exploited, although they demonstrated the full attack in a proof of concept shared with SAP.
The context matters, however. According to BleepingComputer, the US CISA lists 14 SAP flaws actively exploited since November 2021, three of which have also been used by ransomware groups. A 10-rated flaw in Commerce Cloud, fixed in August, was reported as exploited a few days after the patch. A picture similar to what was seen with scans on Oracle E-Business Suite after the patch.
Limits to know
SAP's notes sit in SAP for Me, which requires a login, so we have not read them. Out-of-maintenance kernels are affected according to Onapsis and may not receive fixes. The sources partly disagree on the numbers, and The Hacker News corrected an error about the Gateway flaw. We do not know whether public exploits will appear.
What changes for those working in digital
If you manage SAP systems, the first step is to inventory your kernels and Web Dispatchers, because a single forgotten instance leaves the flaw open. RedRays recommends a single release covering all 17 fixes of the month. For the Gateway, check prxyinfo, since the patch alone is not enough if the list is permissive. For SAML there is no workaround. Disabling WebSocket is a stopgap that breaks some Fiori functions and ABAP Push Channels. Those hosting critical systems on their own servers can rely on hosting with managed security updates.
Our take
The most uncomfortable fact is not the score, but that protection depends on configuration. A Gateway with a permissive proxy list remains exposed at any patch level, and on certain kernels a higher level does not mean the fix is present. Anyone who applies the patch and closes the ticket risks false security. Patches need to be verified, not just installed. The same rule applies to managing Linux kernels.
Frequently asked questions
Are SAP's November flaws already being exploited?
The sources report no attacks. Onapsis states it has not seen ICM2SHELL and PROXYGATE being exploited, but working proofs of concept have been shared with SAP.
Are credentials needed to exploit them?
No. According to SAP and Onapsis, no user, password or user action is required, and the attacker only needs network access to the component.
What is the difference between ICM2SHELL and PROXYGATE?
ICM2SHELL is a memory error shared by ICM and Web Dispatcher. PROXYGATE concerns the Gateway, which can be tricked into treating an external attacker as an internal application server.
Is disabling WebSocket enough?
No, it is only a stopgap. It blocks the bug in ICM and Web Dispatcher, but breaks features such as ABAP Push Channels and some Fiori functions.
Where can I find the official instructions?
In the SAP bulletin and in the notes on SAP for Me, which requires a login. The ACN refers to the vendor bulletin for updates.
What to check on SAP systems in the coming weeks
The risk now shifts from discovery to how quickly systems get updated. Three things are worth watching.
- Follow any reports of active exploitation, including from CISA and ACN.
- Verify whether kernels 7.93 have the correct level, since patch 419 is still reported as vulnerable.
- Plan the move from out-of-maintenance kernels to supported versions.
