SAP Patched Four CVSS 10 Flaws Today. Two Need Only Network Access to a Web Port or Gateway Port, No Login. Onapsis Says Not Exploited Yet. Here Is the Check That Tells You Whether You Are Exposed

Patrick Duggan

2 hours ago

5 min read

If you run SAP, find every SAP Internet Communication Manager, Web Dispatcher and Gateway you have, note each one's kernel release and patch level, and start with the ones reachable from the internet. SAP's November 2026 Security Patch Day, released Tuesday November 10, fixed four vulnerabilities rated CVSS 10.0. Onapsis, which found three of them, says two need no credentials: ICM2SHELL (a flaw in the web server layer) and PROXYGATE (a flaw in the SAP Gateway). Onapsis says it has not seen either exploited in the wild. It also says it gave SAP a working exploit for each, so a public one is plausibly weeks, not months, away.

The four, as BleepingComputer and Onapsis describe them

CVE-2026-76964: memory corruption in the Internet Communication Manager (ICM) of NetWeaver Application Server ABAP.
CVE-2026-89126: the same flaw in SAP Web Dispatcher. Onapsis tracks these two together as ICM2SHELL.
CVE-2026-89103: broken access control in SAP Gateway. Onapsis calls it PROXYGATE and describes pre-authentication remote code execution.
CVE-2026-120017: missing authentication in the SAML2 Service Provider component of NetWeaver AS ABAP. We read nothing beyond BleepingComputer's one line about this one, so we say no more.

SAP patched 35 vulnerabilities in this release. The primary sources for the two Onapsis flaws are its own threat advisories, published November 10, which we read in full. We did not open SAP's notes behind the support login.

ICM2SHELL ([CVE-2026-76964](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-76964) and [CVE-2026-89126](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-89126))

Onapsis: a memory corruption flaw in how the SAP Kernel reassembles WebSocket messages. The ICM and the Web Dispatcher share that code. The result is remote code execution as the system's adm user, or a crash of the process on demand. It needs network access to the HTTP or HTTPS port and, in Onapsis's words, "No credentials, no user interaction and no misconfiguration are required." WebSocket support is on by default even if no application uses it, and some default S/4HANA services accept WebSocket connections without authentication.

Which systems: anything on NetWeaver AS ABAP with kernel 7.40 or higher, and any Web Dispatcher, including the one inside HANA XS. NetWeaver AS Java and kernel 7.22 are not affected. Kernels 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 are affected and may never get a fix, so those need a move to a supported kernel.

Fixed kernel patch levels Onapsis lists: 7.53 at 1616 or 1617, 7.54 at 710, 7.77 at 914, 7.93 at 401 or 420, 9.16 at 111, 9.18 at 37, and 9.20 at 11 or 13. For 7.93, a higher number is not always a fix: patch level 419 is still affected. The fix notes are SAP Note 3778530 (ICM), 3778556 (Web Dispatcher) and the FAQ note 3778788. Every application server and every Web Dispatcher needs the kernel update, not only the primary one. A compromised Web Dispatcher sits in front of every system it routes to.

If you cannot patch today, Onapsis lists two temporary measures, both from the FAQ note. One is to put a Web Dispatcher at a higher patch level in front of the backend (7.53 at 1629, 7.54 at 723, 7.93 at 430, 9.16 at 200 or above); it protects only backends reachable solely through it. The other is to switch off WebSocket upgrade with the parameter icm/HTTP/support_websocket_upgrade set to FALSE and restart, which SAP warns can break interactive and integration scenarios. Check the HTTP log for status 101 first to see whether anything uses WebSocket.

Detection per Onapsis: each attempt will probably crash the ICM or Web Dispatcher at least once, so look for unexpected restarts in the dev_icm or dev_webdisp trace files and process ID changes outside maintenance.

PROXYGATE ([CVE-2026-89103](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-89103))

Onapsis: a pre-authentication remote code execution flaw in the SAP Gateway, in the CPI-C layer, that "works by convincing the SAP Gateway that an unauthenticated, external attacker is one of the internal application servers." Commands run as the system's adm user. Whether you are exposed depends on the gateway's proxy access list, so Onapsis says "neither a version check nor patching alone tells you whether you are safe."

The check, in Onapsis's order: if a prxyinfo file exists and is permissive (for example one that allows any source to any destination), the system is vulnerable at any patch level; a restrictive file means it is not exploitable from untrusted networks, though you should still patch. If there is no prxyinfo file, look at the parameter gw/acl_mode_proxy: it ships as 0, which allows all proxy connections, and setting it to 1 is the fix (SAP Note 3224889, hardening guidance in Note 2926224).

Fix: SAP Note 3798345, FAQ note 3810197. Minimum kernel patch levels Onapsis lists: 7.22 at 1612, 7.53 at 1625, 7.54 at 718, 7.77 at 915, 8.04 at 244, 9.20 at 16 and 9.21 at 4. Kernels 7.93 and 9.16 already support the parameter, so setting it is enough. SAP lists no official workaround. Hardening secinfo and reginfo files does not take a system out of scope. Restricting gateway ports (33NN and 48NN) to the hosts that need RFC access reduces exposure but does not fix the flaw, and an internet-exposed gateway should be closed at the perimeter now.

What to do

Inventory by kernel release and patch level, including standalone Web Dispatchers, ones embedded in HANA XS, non-production systems that hold copies of production data, and old kernels.
Internet-facing ICMs, Web Dispatchers and Gateways first. If a gateway port is open to the internet, close it today.
Patch to the levels above, or apply the workarounds as a bridge, and read the SAP Notes before you do: they are the authority, and Onapsis's tables are a summary.
Run the PROXYGATE check on every gateway, whatever its patch level.
After patching, look for the signs of past attempts: unexplained restarts, and new or changed processes under the adm user.
Watch CISA's KEV catalog. SAP has 14 flaws on it since November 2021, three used by ransomware groups according to BleepingComputer, and one SAP Commerce Cloud flaw (CVE-2026-58231) was flagged as exploited days after its patch in August.

What is not known

Whether anyone is exploiting these. Onapsis says not as of its publication; it will update its posts if that changes. How the fourth flaw, in the SAML2 component, works or which versions it affects. Whether exploit code will become public; two of the four have working ones in vendor hands. No indicators of compromise are published for any of them, so we ingest none.

How we know, and how we checked

We read Onapsis's ICM2SHELL and PROXYGATE advisories in full, and BleepingComputer's summary of the full SAP release, which is where the other two CVEs come from. We did not read SAP's own notes, which sit behind a login, so every patch level and note number is Onapsis's. A search for the product and flaw names against our corpus found no earlier post of ours on these. We did not run an edge check: SAP's web dispatcher and gateway ports are not something our decoys emulate, so a zero would mean nothing. We did not test any system.

Sources

Onapsis, "ICM2SHELL (CVE-2026-76964 / CVE-2026-89126)" and "PROXYGATE (CVE-2026-89103)" threat advisories, November 10, 2026. BleepingComputer, "SAP patches ICM2SHELL and PROXYGATE maximum severity flaws," November 10, 2026. The Hacker News, "SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution," November 10, 2026.