SAP patches ICM2SHELL and PROXYGATE flaws that allow remote system takeover

Feeds.4Sysops •IT News • November 10, 2026

SAP has patched four maximum-severity vulnerabilities, including flaws dubbed ICM2SHELL and PROXYGATE, in its November 2026 security updates. They affect NetWeaver, the application platform behind SAP business software, as well as Web Dispatcher and Gateway, which route requests and connect external applications to SAP systems. Attackers can exploit the flaws remotely without credentials to compromise affected systems. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SAP Patches Four Critical CVSS 10.0 Vulnerabilities on November 2026 Patch Day On November 10, 2026, SAP released security updates addressing four critical vulnerabilities rated CVSS 10.0. These include ICM2SHELL (CVE-2026-76964 and CVE-2026-89126), affecting the Internet Communication Manager and Web Dispatcher, and PROXYGATE (CVE-2026-89103) in SAP Gateway. A missing authentication flaw in the SAML2 Service Provider (CVE-2026-120017) was also patched. All four vulnerabilities allow unauthenticated attackers to execute remote code or impersonate users, posing significant risks to enterprise systems. SAP recommends immediate patching due to the potential for exploitation without user interaction. The vulnerabilities affect a wide range of SAP products, including NetWeaver and S/4HANA, and could lead to full system compromise. Onapsis, which discovered three of the vulnerabilities, has not observed any in-the-wild exploitation yet. 14 sources 72

SAP patches ICM2SHELL and PROXYGATE flaws that allow remote system takeover

The full story

Extracted Entities

Platforms (3)

Vulnerabilities (2)