SAP ICM2SHELL and PROXYGATE: Four CVSS 10.0 Flaws Patched

SAP's November 2026 Security Patch Day fixed four CVSS 10.0 flaws that unauthenticated attackers can use to fully compromise NetWeaver systems. Two of them, ICM2SHELL (CVE-2026-76964 and CVE-2026-89126), give remote code execution through WebSocket traffic on the ICM and Web Dispatcher. PROXYGATE (CVE-2026-89103) abuses SAP Gateway, and CVE-2026-120017 bypasses SAML login. No exploitation is reported yet.

SAP released 35 new security notes this month, according to its November 2026 security notes page. Four carry the maximum score, and NVD lists all four, including CVE-2026-76964 and CVE-2026-89103, as CVSS 10.0 with no privileges or user interaction required. Onapsis Research Labs found three of them and named two: ICM2SHELL for the pair of memory corruption bugs, and PROXYGATE for the Gateway flaw. SAP NetWeaver is the application server under SAP ERP and S/4HANA, so these bugs sit in front of finance, supply chain and HR data.

ICM2SHELL is a memory corruption bug in how the SAP kernel handles WebSocket traffic. The Internet Communication Manager and the Web Dispatcher share that code, so the component many companies put at the edge of their network is affected. In its ICM2SHELL advisory, Onapsis says an attacker who can reach the HTTP or HTTPS port can run operating system commands as the <sid>adm user, or crash the process. WebSocket support is on by default whether or not it is used.

PROXYGATE (CVE-2026-89103) works differently. SAP Gateway uses access control lists to decide which programs may register with it, and in vulnerable setups an outside attacker can pass as one of the system's own application servers. CVE-2026-120017 affects the SAML 2.0 service provider in AS ABAP: on some single sign-on setups, an attacker can submit a crafted assertion and log in as any user, including privileged accounts.

Which SAP systems are affected by ICM2SHELL and PROXYGATE?

Is the SAP November patch enough to fix PROXYGATE?

Not on its own. In its PROXYGATE advisory, Onapsis says that on most kernel releases SAP's fix combines a kernel patch with setting the profile parameter gw/acl_mode_proxy = 1. Some Gateway configurations are not exploitable, but many defaults are, so a version check alone does not tell you whether a system is safe. The same advisory notes the flaw also reaches AS Java, dual-stack and standalone Gateway systems.

For ICM2SHELL, patch the kernel and every Web Dispatcher in one rollout, including dispatchers embedded in HANA. If you cannot patch immediately, restrict who can reach ICM and Web Dispatcher ports from outside, and review which ICF services accept unauthenticated WebSocket connections. For CVE-2026-120017, prioritize systems that use SAML single sign-on.

Is ICM2SHELL being exploited?

Not yet. Onapsis says it has not observed in-the-wild exploitation, and none of the four flaws is in CISA's Known Exploited Vulnerabilities catalog as of November 10. EPSS scores are not yet available because the CVEs were published on November 10. History argues against waiting: CISA has flagged 14 SAP flaws as exploited since November 2021, three of them by ransomware groups, per BleepingComputer. That includes the Commerce Cloud bug we covered in August, which threat intelligence firm Defused reported was exploited days after its patch.

Our read

Four pre-authentication 10.0s in one month is unusual even for SAP, and the edge placement of Web Dispatcher makes ICM2SHELL the one to schedule first. PROXYGATE is the one most likely to be "patched" but still open, because the fix needs a profile parameter as well as the kernel update. Treat a missing EPSS score as "too new to score", not "low risk". Our guides on how to prioritize vulnerabilities beyond CVSS and what CISA KEV is explain how to weigh these, and see our earlier SAP NetWeaver ABAP flaw coverage. To check what your internet-facing web and API endpoints actually expose, Nexus Void runs VAPT on web apps, APIs and mobile apps.

Reporting by BleepingComputer and The Hacker News; research by Onapsis; CVSS per NVD.