VULNpocalypse
CriticalVulnerabilityPatch available

SAP ICM2SHELL and PROXYGATE: four CVSS 10.0 flaws patched

SAP patched four CVSS 10.0 NetWeaver, Web Dispatcher and Gateway flaws on Nov 10, 2026; apply the SAP Notes and check prxyinfo.

Published
Updated
Fixed in
SAP Notes 3778530 (ICM), 3778556 (Web Dispatcher), 3798345 (Gateway), 3849308 (SAML2)
Exploitation
No, Onapsis says it has not seen exploitation in attacks, per The Hacker News and GBHackers

Live scores

CVE-2026-76964
EPSS
0.004
low predicted chance of attack
VEDAS
0.511
likely exploited
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-89126
EPSS
0.004
low predicted chance of attack
VEDAS
0.510
likely exploited
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-89103
EPSS
0.003
low predicted chance of attack
VEDAS
0.510
likely exploited
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-120017
EPSS
0.003
low predicted chance of attack
VEDAS
0.510
likely exploited
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

On November 10, 2026, SAP released its monthly security updates. The Hacker News reports that four flaws exploitable without logging in are rated 10.0, the maximum CVSS score, by the vendor. BleepingComputer says SAP rated them 10/10 and that unauthenticated attackers can exploit them to fully compromise the targeted systems remotely.

  • CVE-2026-76964 (Internet Communication Manager, NetWeaver AS ABAP) and CVE-2026-89126 (SAP Web Dispatcher). SecurityWeek describes them as a single weakness in the kernel component that handles HTTP, HTTPS and WebSocket traffic. Onapsis calls it ICM2SHELL. It involves reassembling fragmented WebSocket messages, and crafted messages write data past the memory reserved for the connection. Onapsis says it gave SAP a working exploit that runs operating system commands as the account that owns the SAP installation (sidadm), per SecurityWeek. The same bug can crash either component, according to The Hacker News.
  • CVE-2026-89103 (SAP Gateway), which Onapsis calls PROXYGATE. BleepingComputer quotes Onapsis saying it convinces the gateway that an unauthenticated external attacker is one of the internal application servers. SecurityWeek ties it to the prxyinfo access-control list.
  • CVE-2026-120017 (SAML2 service provider, NetWeaver AS ABAP). The Hacker News says it could let an attacker log in as any user on some SAML single sign-on systems. SecurityWeek describes it as missing authentication that, in certain configurations, lets unauthenticated attackers impersonate arbitrary users.

Exploitation: The Hacker News says the researchers have not seen ICM2SHELL or PROXYGATE exploited in attacks. GBHackers says Onapsis observed no exploitation in the wild when it published its advisories. Exploitation of CVE-2026-120017 is not confirmed in the sources.

Counts differ between outlets. BleepingComputer says 35 vulnerabilities were patched. SecurityWeek says 42 new and updated notes, nine of them critical. GBHackers refers to three critical flaws, the ones Onapsis found.

Am I affected?

Affected versions differ by component, according to The Hacker News, which cites SAP’s November bulletin:

  • CVE-2026-76964 (ICM): KRNL64UC 7.53 and KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20. SAP NetWeaver AS Java is not affected, per RedRays as cited there.
  • CVE-2026-89126 (Web Dispatcher): HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, KERNEL 7.53 through 9.20 as listed in the article. Standalone and embedded dispatchers are affected, including HANA XS Classic and XS Advanced.
  • CVE-2026-89103 (Gateway): KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, and KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21. Any system that runs a gateway is in scope, including AS Java, dual-stack and standalone gateways.
  • CVE-2026-120017 (SAML2): SAP_BASIS 702, 731, 740, 750 through 758, 816, 920, 921, 922. Systems using SAML2 for browser logon should be treated as in scope until shown otherwise, per RedRays as cited by The Hacker News.

Out-of-maintenance kernels are also affected, per Onapsis as cited by The Hacker News. Its advisories list kernels 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 for ICM2SHELL, plus 7.20 and 7.21 for PROXYGATE. These may not get a fix and need an upgrade to a maintained kernel.

Exposure conditions differ. GBHackers says WebSocket support is on by default, so ICM2SHELL needs no misconfiguration. PROXYGATE depends on the gateway proxy policy: hardening secinfo or reginfo does not stop it, and permissive prxyinfo rules stay dangerous regardless of patch level.

What to do now

  1. Apply the SAP Notes through SAP for Me (sign-in required): 3778530 (ICM), 3778556 (Web Dispatcher), 3798345 (Gateway) and 3849308 (SAML2). The vendor recommends applying them as a priority, per The Hacker News. RedRays advises updating the kernel and all Web Dispatchers in one rollout, and finding every Web Dispatcher first because one missed instance leaves the flaw open.
  2. Check the gateway proxy list (prxyinfo) first, starting with internet-reachable gateways. A permissive list leaves a system exposed at any patch level. Where no prxyinfo file exists, gw/acl_mode_proxy decides and ships set to 0, which allows every proxy connection. Remediation generally combines a kernel update with gw/acl_mode_proxy=1, per GBHackers and The Hacker News. Kernels 7.93 and 9.16 already have the parameter, and others gain it with the kernel patch. The kernel patch alone does not take a system out of scope. See also FAQ note 3810197, cited by GBHackers.
  3. Restrict gateway ports 33NN and 48NN to hosts that need RFC access, per The Hacker News and GBHackers.
  4. For ICM2SHELL, check patch levels carefully. The Hacker News relays the ICM2SHELL advisory warning that on release 7.93, patch level 419 is still vulnerable, and only the updated 401 Stack Kernel, 402 once released, and 420 or later carry the fix. Patching a Web Dispatcher to the levels in FAQ note 3778788 shields the ICM only if nobody can reach the ICM ports directly, and the shield does not work on a Web Dispatcher set up as a router (PROT=ROUTER).
  5. If you cannot patch yet, turning off WebSocket support (icm/HTTP/support_websocket_upgrade=FALSE) is a stopgap. It needs a restart and may break features such as ABAP Push Channels and some Fiori functions, and it does not replace patching, per GBHackers and The Hacker News.
  6. For CVE-2026-120017 there is no workaround, so the correction instructions or the listed support package are the only fix. RedRays also suggests reviewing the trusted identity providers in transaction SAML2 and checking audit logs for SAML logons by privileged users from unexpected sources, per The Hacker News.
  7. Investigate unexpected dev_icm or dev_webdisp restarts, per GBHackers.

Sources