"ICM2SHELL turns a routine part of web traffic into a point of ingress for attackers. [..] The result is remote code execution against the component that faces the network by design: no SAP user, no password and no user interaction," Onapsis said.
Four maximum-severity flaws: ICM2SHELL and PROXYGATE
SAP's November 2026 security updates fixed 35 vulnerabilities, including four the company rated maximum severity (CVSS 10/10). Two of those maximum-severity flaws are tracked by cybersecurity firm Onapsis as ICM2SHELL — CVE-2026-76964 and CVE-2026-89126 — and a third is tracked as PROXYGATE — CVE-2026-89103. The remaining maximum-severity issue is CVE-2026-120017, a missing-authentication flaw in a NetWeaver SAML2 Service Provider component.
Components in the crosshairs: NetWeaver, Gateway, Web Dispatcher
SAP named the affected products: the NetWeaver Application Server ABAP's Internet Communication Manager (ICM) and SAML2 Service Provider; SAP Gateway; and SAP Web Dispatcher. The company described NetWeaver as the core application platform that underpins its business software and handles application integration, authentication, user management, and data processing. Gateway is a core framework that enables external applications to connect securely to SAP backend systems, while Web Dispatcher — deployed in almost every enterprise SAP environment — acts as a load balancer and reverse proxy for web requests entering an SAP system architecture.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogOnapsis' technical warnings and exploitability
Onapsis, which reported three of the issues, described how the flaws enable unauthenticated, remote compromise. For PROXYGATE the firm said: "PROXYGATE works by convincing the SAP Gateway that an unauthenticated, external attacker is one of the internal application servers. [..] There is no SAP user, no password, and no user interaction, yet full control of the SAP system as the account that owns the installation is achieved. On a production ERP system, that means direct exposure of the business data, transaction integrity, and the availability of critical business applications."
SAP corroborated the severity assessment by assigning a 10/10 CVSS score to the four flaws and stated that unauthenticated attackers can exploit them to fully compromise targeted systems remotely.
Recent pattern: other maximum-severity fixes and CISA tracking
The November patches continue a run of maximum-severity fixes from SAP in recent months. In August SAP patched CVE-2026-58231 in the Commerce Cloud e-commerce platform, which threat intelligence firm Defused flagged as exploited days after the patch. In September and October SAP addressed CVE-2026-44756 (a memory corruption flaw in the SAP Kernel tracked as OVERPASS by Onapsis) and CVE-2026-89111 (an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged 14 SAP security flaws as actively exploited since November 2021; three of those were also abused by ransomware groups in the wild.
That recent history — patches followed quickly by reports of in-the-wild exploitation — is the backdrop for the November fixes.
What this means for technologists, enterprises, and regulators
- Technologists and security teams: organisations running NetWeaver, Gateway, or Web Dispatcher face flaws that Onapsis describes as allowing unauthenticated remote code execution "no SAP user, no password and no user interaction." Teams responsible for those components will need to identify affected installations and evaluate SAP's November updates.
- Affected enterprises and procurement leaders: SAP reported revenues exceeding €36 billion in fiscal year 2025 and serves 99 of the 100 largest companies worldwide, underscoring the potential enterprise impact if these flaws are exploited on production ERP systems where business data, transaction integrity, and application availability are at stake.
- Policymakers and regulators: CISA's prior flagging of 14 actively exploited SAP flaws since November 2021 — with ransomware among the attackers in three cases — positions national and sectoral security authorities to watch whether these newly patched issues show signs of exploitation.
SAP's November bulletin joins several high-severity advisories this year and, in the words of its reporters, describes vulnerabilities that can convert routine web traffic into an attacker channel with no credentials required. Whether those characteristics motivate active exploitations in the coming days and weeks remains an open question; organisations that run the named components will be watching for indicators from SAP, Onapsis, and CISA while they apply the released fixes.
