Skip to content
SAP Patches Four Critical CVSS 10.0 Vulnerabilities on November 2026 Patch Day

SAP Patches Four Critical CVSS 10.0 Vulnerabilities on November 2026 Patch Day

First seen 10 Nov 2026, 11:11 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 15:48 UTC
  • •SAP patched four critical vulnerabilities with a CVSS score of 10.0 on November 10, 2026.
  • •Vulnerabilities include ICM2SHELL and PROXYGATE, allowing remote code execution without authentication.
  • •Immediate patching is recommended due to the high risk of exploitation.

On November 10, 2026, SAP released security updates addressing four critical vulnerabilities rated CVSS 10.0. These include ICM2SHELL (CVE-2026-76964 and CVE-2026-89126), affecting the Internet Communication Manager and Web Dispatcher, and PROXYGATE (CVE-2026-89103) in SAP Gateway. A missing authentication flaw in the SAML2 Service Provider (CVE-2026-120017) was also patched. All four vulnerabilities allow unauthenticated attackers to execute remote code or impersonate users, posing significant risks to enterprise systems. SAP recommends immediate patching due to the potential for exploitation without user interaction. The vulnerabilities affect a wide range of SAP products, including NetWeaver and S/4HANA, and could lead to full system compromise. Onapsis, which discovered three of the vulnerabilities, has not observed any in-the-wild exploitation yet.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-11-10
SAP Security Patch Day
SAP released 35 security notes, including four critical vulnerabilities rated CVSS 10.0.
BleepingComputer
2026-11-10
ICM2SHELL and PROXYGATE vulnerabilities disclosed
ICM2SHELL affects the Internet Communication Manager and Web Dispatcher, while PROXYGATE impacts SAP Gateway.
The Hacker News
2026-11-10
Onapsis reports vulnerabilities
Onapsis discovered three of the four critical vulnerabilities and provided SAP with proof-of-concept exploits.
Onapsis
2026-11-10
CVE-2026-120017 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-10
CVE-2026-89103 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (29)

Following this threat?

Track SAP and CVE-2026-109795 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (32)

1 / 3

Common questions

Which SAP products are affected?
The vulnerabilities affect SAP NetWeaver, Web Dispatcher, and Gateway, among others.
How urgent is the patching process?
Patching is urgent due to the critical nature of the vulnerabilities and the risk of remote exploitation.
What should organizations do first?
Organizations should prioritize applying the patches released on November 10, 2026, to mitigate risks.