SAP patches ICM2SHELL and PROXYGATE maximum-severity flaws

SAP has patched 35 vulnerabilities in its November 2026 security updates, including four that it rated 10/10 on the CVSS severity scale. The flaws affect its NetWeaver, Web Dispatcher and Gateway software. SAP said unauthenticated attackers could exploit them remotely to fully compromise targeted systems.

Two flaws affect NetWeaver components: memory corruption in the Internet Communication Manager (CVE-2026-76964) and missing authentication in the SAML2 Service Provider (CVE-2026-120017). The other two are broken access control in SAP Gateway (CVE-2026-89103) and memory corruption in SAP Web Dispatcher (CVE-2026-89126).

Onapsis, which found and reported three of the issues, groups CVE-2026-76964 and CVE-2026-89126 under the name ICM2SHELL, and calls CVE-2026-89103 PROXYGATE. The company said ICM2SHELL could allow remote code execution without an SAP user, password or user interaction. It said PROXYGATE could let an unauthenticated external attacker pose as an internal application server and gain control of an SAP system.

SAP has also fixed other maximum-severity flaws in recent months. It patched CVE-2026-58231 in Commerce Cloud in August. In September and October, it addressed CVE-2026-44756 in SAP Kernel and CVE-2026-89111, an OAuth2 SSRF flaw affecting multi-tenant BTP applications. CISA has flagged 14 SAP vulnerabilities as actively exploited since November 2021; ransomware groups also exploited three of them.