Skip to content
SAP patches four maximum-severity flaws, including Onapsis

SAP patches four maximum-severity flaws, including Onapsis

Mlq.Ai • November 10, 2026

SAP released 35 new security notes on November 10: nine Critical, 17 High, and four with the maximum CVSS score of 10.0 [1] .

Onapsis found three of the four: ICM2SHELL (CVE-2026-76964 and CVE-2026-89126), WebSocket memory corruption in the ICM and Web Dispatcher, and PROXYGATE (CVE-2026-89103) in SAP Gateway [2] [3] .

Onapsis says it has not observed in-the-wild exploitation, but it built a working end-to-end exploit for ICM2SHELL [2] .

SAP fixed four vulnerabilities carrying the maximum CVSS severity score of 10.0 in its November Security Patch Day on Tuesday, part of 35 new security notes, nine of them rated Critical and 17 High [1] . SAP says unauthenticated attackers could use any of the four to compromise affected systems remotely, BleepingComputer reported [4] .

Three of the four came from SAP security firm Onapsis, which has given them names [4] . ICM2SHELL covers two bugs, CVE-2026-76964 in the Internet Communication Manager (ICM) of NetWeaver AS ABAP and CVE-2026-89126 in SAP Web Dispatcher [1] [2] . PROXYGATE, CVE-2026-89103, is a broken access control flaw in SAP Gateway [1] [3] . The fourth, CVE-2026-120017, is a missing-authentication bug in the SAML2 Service Provider of NetWeaver AS ABAP and ABAP Platform [1] .

ICM2SHELL is a memory corruption bug in how the SAP Kernel reassembles fragmented WebSocket messages, code that the ICM and Web Dispatcher [2] . Onapsis says exploitation needs no credentials, user interaction or misconfiguration, because WebSocket is on by default and some default S/4HANA services accept WebSocket connections without authentication. It leads to code execution as the system's administrator account or to a crash [2] . Onapsis says it built a working end-to-end exploit, and because the ICM and Web Dispatcher are built to face the internet, many deployments can be attacked from outside the corporate network [2] . Systems on kernel 7.40 or later are affected, including the Web Dispatcher embedded in SAP HANA XS; Java-only systems are not [2] .

PROXYGATE tricks SAP Gateway into treating an unauthenticated outside attacker as one of the system's own application servers, letting the attacker run operating system commands [3] . Onapsis says the kernel patch alone is not enough: administrators also need to tighten the gateway's proxy access list or set the new gw/acl_mode_proxy parameter, because the shipped default allows all connections [3] . For both bugs, several out-of-maintenance kernels are affected and must be upgraded rather than patched [2] [3] .

Onapsis says it had not observed exploitation in the wild as of Tuesday [2] [3] . SAP bugs have been exploited quickly before: CISA has flagged 14 SAP flaws as actively exploited since November 2021, and an August maximum-severity bug in SAP Commerce Cloud was attacked days after its patch, according to BleepingComputer [4] . Microsoft's monthly Patch Tuesday updates are also due later today.