SAP’s November 2026 Security Patch Day fixed 35 vulnerabilities, four of them rated 10.0, the maximum CVSS score. SAP says all four can be exploited by an unauthenticated attacker over the network, with no user interaction. They affect SAP NetWeaver Application Server ABAP (the ICM and SAML components), SAP Web Dispatcher and SAP Gateway:
- CVE-2026-76964 (Internet Communication Manager, ICM) and CVE-2026-89126 (SAP Web Dispatcher): memory corruption that could let an attacker run code on the system. Onapsis, the SAP security firm that found them, says both come from one bug, which it calls ICM2SHELL, in kernel code that reassembles split WebSocket messages.
- CVE-2026-89103 (SAP Gateway): the gateway can be convinced that an outside attacker is one of the system’s own application servers. Onapsis calls it PROXYGATE and says the attacker could then run operating system commands as the account that owns the SAP installation.
- CVE-2026-120017 (SAML 2.0 service provider): per The Hacker News, SAP says an attacker could log in as any user, including privileged ones, on some systems that use SAML single sign-on, and RedRays says that under certain configurations the service provider did not check signatures on incoming sign-in assertions.
Onapsis says it gave SAP working proof-of-concept exploits for the ICM, Web Dispatcher and Gateway flaws and has not seen any of them exploited in attacks. SAP has patched other maximum-severity flaws in recent months, including OVERPASS in September (SAP Patches CVSS 10.0 OVERPASS Kernel Flaw With RCE Risk), and BleepingComputer notes one from August (CVE-2026-58231, Commerce Cloud) that threat intelligence firm Defused flagged as exploited days after the patch.
How to check if you’re affected
Affected products are SAP systems running a vulnerable kernel or Web Dispatcher (ICM2SHELL, PROXYGATE) or a vulnerable ABAP basis release (SAML2); each flaw has its own SAP Note, and the notes sit in SAP for Me, which needs a sign-in.
- ICM2SHELL (Notes 3778530 and 3778556): exposure is set by the SAP Kernel, not the application release, and applies to NetWeaver AS ABAP on kernel 7.40 or higher and to any Web Dispatcher, including the one embedded in SAP HANA XS. AS Java is not affected, but dual-stack systems are, through their ABAP stack. Onapsis lists these fixed patch levels: kernel and Web Dispatcher 7.53 PL 1616/1617, 7.54 PL 710, 7.77 PL 914, 7.93 PL 401/420, 9.16 PL 111, 9.18 PL 37 (kernel), 9.20 PL 11/13 (kernel). On 7.93 a higher patch level is not always a fixed one: PL 419 is still vulnerable. Kernels out of maintenance (7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85, 7.89) are also affected and may not get a fix, so they need an upgrade. Check the Web Dispatcher in front of your systems separately, since it is affected on its own. WebSocket support is on by default, according to The Hacker News.
- PROXYGATE (Note 3798345): affects any system running a gateway, including AS Java, dual-stack and standalone gateways. Per The Hacker News’s account of Onapsis’s advice, check the gateway’s proxy list (
prxyinfo) first: a permissive list leaves a system exposed at any patch level. Where there is noprxyinfofile, the profile parametergw/acl_mode_proxydecides, and it ships set to 0 (all proxy connections allowed). Kernel 7.93 and 9.16 already have the parameter and need it set to 1; the kernel patch alone, without a restrictiveprxyinfoor that setting, does not take a system out of scope. - SAML2 (Note 3849308): affects
SAP_BASISreleases 702, 731, 740, 750 through 758, 816, 920, 921 and 922, according to The Hacker News’s summary of SAP’s bulletin. It cites RedRays for the advice that there is no workaround, to treat any AS ABAP system that uses SAML2 for browser logon as in scope, and to review trusted identity providers in transactionSAML2and audit logs for SAML logons by privileged users from unexpected sources.
The Hacker News also reports that RedRays advises updating the kernel and all Web Dispatchers in a single rollout. We did not read SAP’s own notes (they need a sign-in), so version lists beyond Onapsis’s patch-level table are attributed to The Hacker News, and the Onapsis PROXYGATE advisory was linked but not read directly.
Sources
- Onapsis: ICM2SHELL (CVE-2026-76964 and CVE-2026-89126) threat advisory
- Onapsis: PROXYGATE (CVE-2026-89103) threat advisory
- SAP Security Notes: November 2026 Patch Day
- BleepingComputer: SAP patches ICM2SHELL and PROXYGATE maximum severity flaws
- The Hacker News: SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution