SAP released 35 new security notes and four GitHub security advisories on November 10, including four critical vulnerabilities rated CVSS 10.0 across NetWeaver, SAP Gateway and Web Dispatcher. The company also updated three previously issued security notes, according to its November 2026 Security Patch Day bulletin.
The four maximum-severity issues are CVE-2026-76964, a memory-corruption flaw in the Internet Communication Manager in SAP NetWeaver AS ABAP; CVE-2026-89126, a memory-corruption flaw in SAP Web Dispatcher; CVE-2026-89103, a broken-access-control flaw in SAP Gateway; and CVE-2026-120017, a missing-authentication issue in the SAML2 Service Provider for SAP NetWeaver AS ABAP and ABAP Platform. SAP lists affected kernel branches including 7.53, 7.54, 7.77, 7.93 and 9.16 through 9.20 for the ICM issue. The SAML2 flaw affects SAP_BASIS 702, 731, 740, 750 through 758, 816, 920, 921 and 922.
Onapsis groups CVE-2026-76964 and CVE-2026-89126 under the name ICM2SHELL. The researcher said the flaws affect shared SAP kernel code that handles WebSocket traffic in the Internet Communication Manager and Web Dispatcher. An attacker with network access to the relevant HTTP or HTTPS port could corrupt process memory and execute operating-system commands as the SAP system administrator account, without credentials or user interaction. Onapsis lists fixed kernel patch levels including 7.53 PL 1616 or 1617, 7.54 PL 710, 7.77 PL 914, 7.93 PL 401 or 420, 9.16 PL 111, 9.18 PL 37 and 9.20 PL 11 or 13. It also lists fixes for SAP HANA 2.0 and SAP Extended Application Services.
Onapsis separately calls CVE-2026-89103 PROXYGATE, a pre-authentication remote-code-execution flaw in SAP Gateway. The company said an unauthenticated attacker could run operating-system commands as the SAP system administrator when the gateway’s proxy access-control policy is permissive or missing. Some configurations prevent exploitation, but Onapsis said the fix also relies on the gateway setting gw/acl_mode_proxy=1 on most affected kernel releases. Its published minimum patch levels include 7.22 EXT PL 1612, 7.53 PL 1625, 7.54 PL 718, 7.77 PL 915, 8.04 PL 244, 9.20 PL 16 and 9.21 PL 4.
Onapsis said its researchers had not observed active in-the-wild exploitation of ICM2SHELL or PROXYGATE as of November 10. SAP’s bulletin lists the affected products, security-note numbers and severity ratings, while the ICM2SHELL research and PROXYGATE advisory describe the two vulnerability groups in more detail.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
