SAP Patches Four CVSS 10.0 Flaws: Pre-Auth RCE in ICM and Web Dispatcher (ICM2SHELL), a Gateway ACL Bypass (PROXYGATE) and SAML2 Login as Any User

Critical · 2026-11-10 · By H.A

SAP Patches Four CVSS 10.0 Flaws: Pre-Auth RCE in ICM and Web Dispatcher (ICM2SHELL), a Gateway ACL Bypass (PROXYGATE) and SAML2 Login as Any User

SAP's November 2026 Patch Day fixes four unauthenticated, maximum-severity flaws across NetWeaver AS ABAP, Web Dispatcher and SAP Gateway — patch the kernel, every Web Dispatcher and the SAML2 note now.

Overview

SAP's November 2026 Security Patch Day, released on 10 November, fixes four vulnerabilities that carry the maximum CVSS score of 10.0. All four share the same vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): they are reachable over the network, need no account, need no user interaction, and their impact extends beyond the vulnerable component.

Three of the flaws sit in the core of SAP NetWeaver Application Server ABAP, and the fourth sits in SAP Web Dispatcher, the reverse proxy and load balancer that usually stands in front of SAP systems and is often exposed to the internet. Two of them allow remote code execution, one lets an attacker impersonate any user through SAML single sign-on, and one lets an outside attacker be treated as a trusted internal application server.

No in-the-wild exploitation has been reported and none of the four is in the CISA Known Exploited Vulnerabilities catalog. But researchers have already given SAP a working exploit for two of them, and SAP systems are a long-standing target for both ransomware crews and state-backed groups. This release should be handled as an emergency change, not as routine monthly patching.

The Vulnerabilities

CVE-2026-76964 — SAP NetWeaver AS ABAP, Internet Communication Manager (SAP Note 3778530). A memory corruption flaw (CWE-1287) in the ICM, the component that handles HTTP and WebSocket traffic for ABAP systems. An unauthenticated attacker sends crafted network traffic to corrupt memory and run arbitrary code. Affected: KRNL64UC 7.53 and KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20. SAP NetWeaver AS Java is not affected.

CVE-2026-89126 — SAP Web Dispatcher (SAP Note 3778556). A heap-based buffer overflow (CWE-122) with the same root cause as the ICM flaw. It affects standalone and embedded Web Dispatchers, including those inside SAP HANA XS Classic and XS Advanced. Affected: HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93 and 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, and KERNEL 7.53 to 9.20.

Researchers who reported these two flaws call the bug ICM2SHELL. It lives in kernel code shared by the ICM and Web Dispatcher that reassembles fragmented WebSocket messages: WebSocket control frames with invalid length fields cause a heap out-of-bounds write before any login. WebSocket support is switched on by default, so systems are exposed even if nothing in the landscape uses WebSockets. The proof of concept runs operating system commands as <sid>adm, the account that owns the whole SAP installation. Even a failed attempt can crash the component, and a crashed Web Dispatcher cuts off every SAP system behind it.

CVE-2026-89103 — SAP Gateway (SAP Note 3798345). Broken access control (CWE-863), named PROXYGATE by its finders. SAP Gateway activates a default access control list with high privileges, which lets an external attacker be classified as an internal application server. Exposure is decided by the proxy list (prxyinfo) or, where that file is missing, by the profile parameter gw/acl_mode_proxy, which ships set to 0 (allow all). It is not decided by the secinfo and reginfo lists that most hardening guides cover. Where proxy settings allow it, the attacker can run OS commands as <sid>adm. Any system running a gateway is affected, including AS Java, dual-stack and standalone gateway installations.

CVE-2026-120017 — SAP NetWeaver AS ABAP SAML2 Service Provider (SAP Note 3849308). Improper verification of a cryptographic signature (CWE-347). Under certain configurations the service provider does not check signatures on incoming SAML assertions, so an unauthenticated attacker can log in as any user, including privileged accounts, and potentially move on to connected systems. Affected: SAP_BASIS 702, 731, 740, 750 to 758, 816, 920, 921 and 922. There is no workaround: the correction instructions or the listed support package are the only fix.

The same release also fixes three critical flaws rated 9.9 that need a low-privileged account, including OS command injection in the ABAP application server (CVE-2026-76965), plus a 9.6-rated cross-site request forgery in Web Dispatcher and the ICM (CVE-2026-89119).

Timeline

Tradecraft

No attacks have been seen yet, but the likely playbook is clear. Internet-facing Web Dispatchers and ICM ports are the first targets for ICM2SHELL, since a single unauthenticated request can give a shell as <sid>adm. PROXYGATE needs network access to gateway ports (33NN and 48NN), which makes it a strong move for an attacker already inside the network, or for any gateway reachable from the internet. The SAML2 flaw is the quietest of the four: a forged assertion produces a normal-looking logon as an administrator, which bypasses MFA enforced at the identity provider.

Past SAP flaws of this class were weaponised within days of public detail appearing, and patch diffing of SAP kernels is a well-practised skill. The window before exploitation should be measured in days, not weeks.

Detection

No CVE-specific indicators of compromise have been published. Useful starting points:

Treat anomalies as leads for investigation, not proof of compromise.

Recommended Actions

  1. Inventory first. Find every Web Dispatcher, standalone and embedded (including HANA XS), every ICM exposed beyond the Web Dispatcher, and every gateway. One missed instance keeps the flaw open.
  2. Patch the kernel and all Web Dispatchers in one rollout to levels that cover all of this month's kernel and Web Dispatcher fixes. Standalone Web Dispatchers use SAPWEBDISP.SAR; embedded ones use dw.sar or the SP Stack Kernel; HANA XS Classic needs SPS08 revision 089.05 or SPS07 revision 079.11; XS Advanced needs 1.5.4 or later. On kernel 7.93, patch level 419 is still vulnerable.
  3. Gateway: patching alone is not enough. Pair the kernel patch with a restrictive prxyinfo or set gw/acl_mode_proxy = 1, and limit ports 33NN and 48NN to hosts that need RFC access.
  4. SAML2: apply SAP Note 3849308, then review every trusted identity provider in transaction SAML2.
  5. Interim measures if you cannot patch tonight: block direct access to ICM ports so traffic only passes through a patched Web Dispatcher (this does not help when the Web Dispatcher runs in router mode), or disable WebSocket support as a last resort, accepting that ABAP Push Channels and some Fiori features will break.
  6. Out-of-maintenance kernels (for example 7.40 to 7.49, 7.73, 7.81, 7.85, 7.89, and for the gateway also 7.20 and 7.21) may never get a fix. Plan an upgrade to a maintained release.

Analyst Assessment

Four unauthenticated 10.0 flaws in one month is unusual even for SAP, and these hit the components every landscape relies on: the HTTP stack, the reverse proxy, the RFC gateway and single sign-on. ICM2SHELL is the most urgent because it is pre-authentication, enabled by default and already has a working exploit in researchers' hands. PROXYGATE is the most likely to be patched badly, since the kernel update does nothing without the matching configuration change. Organisations running SAP ERP or S/4HANA should treat this as a priority-one change this week, starting with anything reachable from the internet.

REEF SENTINEL