Thought Leadership
The November Patch Day comprises 35 new security notes, nine of them critical. Four vulnerabilities can be exploited remotely without authentication.
SAP has released its monthly security updates. The Patch Day comprises 35 new security notes, four security advisories on GitHub, and three updates to earlier notes. SAP rates nine of them as critical, 17 as high. Four vulnerabilities received the highest CVSS score of 10.0. They affect SAP NetWeaver, the SAP Web Dispatcher, and SAP Gateway and, according to SAP, can be exploited remotely without authentication to completely take over affected systems. There are no indications of active attacks so far.
ICM2SHELL via WebSocket Traffic
Onapsis, a company specializing in SAP security, found three of the four vulnerabilities. Under the name ICM2SHELL, it groups together two memory errors: CVE-2026-76964 in the Internet Communication Manager (ICM) of NetWeaver AS ABAP and CVE-2026-89126 in the SAP Web Dispatcher. They are triggered via WebSocket connections. The components are designed to accept requests from the network.
“ICM2SHELL turns an ordinary part of web traffic into a gateway for attackers.”
Onapsis
Attackers required neither an SAP user nor a password or user interaction.
PROXYGATE Spoofs Internal Servers
The third vulnerability found by Onapsis, PROXYGATE (CVE-2026-89103), is located in SAP Gateway. It causes the gateway to mistake an external, unauthenticated attacker for one of the internal application servers. The cause is faulty access control in the default configuration. As a result, attackers can execute code with the privileges of the account that owns the SAP installation. The fourth vulnerability with CVSS 10 (CVE-2026-120017) affects login via SAML2 in AS ABAP. Through it, attackers can impersonate any user. Added to this are three critical vulnerabilities with a score of 9.9, for which attackers, however, require a low-privileged user account.
Gateway, Web Dispatcher, and ICM First Administrators should update SAP Gateway, Web Dispatcher, and ICM first, as attackers can reach these components without credentials. Kernel updates are required for ICM and Web Dispatcher. How quickly attackers react is shown by a report from Onapsis and Recorded Future from October: For SAP vulnerabilities patched in 2025 and 2026, a median of only one to three days elapsed until the first exploit or public proof of concept. A maximum-severity vulnerability in SAP Commerce Cloud was attacked in August just a few days after the patch. The US agency CISA has classified 14 SAP vulnerabilities as actively exploited since November 2021.
(Editorial Team)
