SAP patches ICM2SHELL and PROXYGATE maximum severity flaws

The source has a clear section order, so I’m drafting five fact headings from that and checking paragraph length before the final piece.The draft is 12 words short of the floor and the deck is three characters over.SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software, according to BleepingComputer's report. The four are memory corruption and missing authentication in NetWeaver Application Server ABAP, broken access control in SAP Gateway, and memory corruption in SAP Web Dispatcher. SAP rated all four 10/10 on the CVSS severity scale and stated that unauthenticated attackers can exploit them to fully compromise the targeted systems remotely.

This piece is for operators of SAP NetWeaver, Web Dispatcher, and Gateway who need the CVE identifiers, the affected components, and the conditions Onapsis described. It covers the Internet Communication Manager and SAML2 Service Provider flaws, the Gateway and Web Dispatcher flaws, the names ICM2SHELL and PROXYGATE, the maximum-severity fixes from August, September, and October, and the 14 SAP flaws CISA has flagged as actively exploited since November 2021.

01Internet Communication Manager and SAML2

SAP addressed memory corruption tracked as CVE-2026-76964 in the Internet Communication Manager of NetWeaver Application Server ABAP. It addressed missing authentication tracked as CVE-2026-120017 in the SAML2 Service Provider, the other ABAP component in this maximum-severity pair. Both flaws are part of the November 2026 security updates, the release that patches 35 vulnerabilities in NetWeaver, Web Dispatcher, and Gateway.

NetWeaver is the core app platform that underpins SAP's business software and handles application integration, authentication, user management, and data processing. The Internet Communication Manager and the SAML2 Service Provider are components of NetWeaver Application Server ABAP, which is the stack SAP named for CVE-2026-76964 and CVE-2026-120017. Those two CVEs are the NetWeaver half of the four maximum-severity issues in the November updates.

02SAP Gateway and Web Dispatcher flaws

The other two maximum-severity vulnerabilities are CVE-2026-89103, a broken access control weakness in SAP Gateway, and CVE-2026-89126, a memory corruption issue in SAP Web Dispatcher. SAP addressed both Gateway and Web Dispatcher flaws in the same November 2026 security updates that fix 35 vulnerabilities. Together with the two NetWeaver Application Server ABAP issues, they are the four vulnerabilities SAP rated 10/10 on the CVSS severity scale.

Gateway is a core framework that enables external apps to securely connect to SAP backend systems. Web Dispatcher, deployed in almost every enterprise SAP environment, is a specialized component that acts as a load balancer and reverse proxy for web requests entering an SAP system architecture. CVE-2026-89103 is the broken access control weakness in Gateway, and CVE-2026-89126 is the memory corruption issue in Web Dispatcher.

03ICM2SHELL ingress and PROXYGATE control

Cybersecurity firm Onapsis found and reported three of the four maximum-severity issues in the November 2026 updates. Onapsis collectively tracks CVE-2026-76964 and CVE-2026-89126 as ICM2SHELL, and it tracks the CVE-2026-89103 pre-auth remote code execution vulnerability as PROXYGATE. "ICM2SHELL turns a routine part of web traffic into a point of ingress for attackers," Onapsis said.

Onapsis said the result is remote code execution against the component that faces the network by design, with no SAP user, no password, and no user interaction. "PROXYGATE works by convincing the SAP Gateway that an unauthenticated, external attacker is one of the internal application servers," Onapsis said. On PROXYGATE, Onapsis said, there is no SAP user, no password, and no user interaction, yet full control of the SAP system as the account that owns the installation is achieved.

On a production ERP system, Onapsis said, that control means direct exposure of the business data, transaction integrity, and the availability of critical business applications. ICM2SHELL names the memory corruption flaws CVE-2026-76964 in the Internet Communication Manager and CVE-2026-89126 in Web Dispatcher. PROXYGATE names the pre-auth remote code execution vulnerability CVE-2026-89103 in SAP Gateway.

04August Commerce Cloud and later flaws

These November fixes are the latest in a string of other maximum-severity flaws SAP has fixed in multiple components in recent months, including Commerce Cloud, the SAP Kernel, and multi-tenant BTP applications. In August, SAP patched CVE-2026-58231 in Commerce Cloud, its cloud-based e-commerce platform. Threat intelligence firm Defused flagged CVE-2026-58231 as actively exploited in attacks days after that August patch.

SAP also addressed two more maximum-severity flaws in September and October, after the August Commerce Cloud patch. One is a memory corruption flaw in the SAP Kernel code, tracked as CVE-2026-44756 and dubbed OVERPASS by Onapsis security researchers who reported it. The other is an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications, tracked as CVE-2026-89111.

05CISA flags and SAP fiscal scale

The US Cybersecurity and Infrastructure Security Agency (CISA) has flagged 14 SAP security flaws as actively exploited since November 2021. Three of those 14 SAP security flaws were also abused in the wild by ransomware groups. Sergiu Gatlan's report on the November 2026 updates is dated November 10, 2026, at 07:07 AM.

SAP is a German multinational software company that reported revenues exceeding €36 billion in fiscal year 2025 and serves 99 of the 100 largest companies worldwide. Its November 2026 security updates fix 35 vulnerabilities, four of them rated 10/10 on the CVSS scale, in NetWeaver, Gateway, and Web Dispatcher.