SAP dropped its November 2026 Security Patch Day today and it is not routine. Four of the 35 new security notes carry a CVSS score of 10.0 — the maximum. All four are exploitable over the network with no credentials and no user interaction. Onapsis, the enterprise security firm that found three of them, built a working proof-of-concept exploit for one. If your organization runs SAP NetWeaver, Web Dispatcher, or Gateway on-premises, these patches belong at the top of your queue right now.
ICM2SHELL: Two CVEs, One WebSocket Bug
The most critical pair — CVE-2026-76964 and CVE-2026-89126 — share a root cause. Both affect the Internet Communication Manager (ICM), the layer that processes HTTP, HTTPS, and WebSocket traffic in SAP NetWeaver and Web Dispatcher respectively. When oversized WebSocket messages arrive in fragments, the ICM’s reassembly code overflows a heap buffer. An attacker sends a crafted fragmented payload and executes arbitrary code as the <sid>adm account — the OS user that owns the entire SAP installation.
Onapsis tracks these two as ICM2SHELL and has confirmed a working end-to-end exploit. No in-the-wild exploitation has been observed as of today’s disclosure, but that window will close fast once the proof-of-concept circulates. Web Dispatcher is internet-facing by design, which makes CVE-2026-89126 the single most urgent patch in this release.
If you cannot patch immediately, disabling WebSocket support removes the attack surface — but be aware that SAP Fiori apps relying on WebSocket and ABAP Push Channels will stop working until you re-enable it after patching.
- CVE-2026-76964 — NetWeaver AS ABAP ICM | SAP Note 3772839
- CVE-2026-89126 — SAP Web Dispatcher (standalone + HANA XS) | SAP Note 3778556
PROXYGATE: The Gateway Trusts the Wrong People
CVE-2026-89103 targets SAP Gateway, which handles external RFC and BAPI connections between SAP and outside programs. The flaw is in the default trust model: Gateway’s default configuration treats external traffic as if it came from an internal application server. An attacker on the network sends traffic that impersonates an internal SAP app server and walks straight in — no account, no password required.
What makes PROXYGATE worth calling out separately is the false sense of security it creates. Many SAP admins have hardened their Gateway deployments by locking down secinfo and reginfo ACL files. That hardening does not protect against PROXYGATE. The vulnerability lives in the kernel, below the ACL layer. Even a fully hardened Gateway remains exploitable without this patch.
The fix requires a kernel update plus setting gw/acl_mode_proxy = 1 in your instance profile or DEFAULT.PFL. After that, review and restrict any permissive prxyinfo rules.
- CVE-2026-89103 — SAP Gateway | SAP Note 3760274 | Requires kernel patch + profile parameter change
CVE-2026-120017: SAML2 Lets Anyone Become Anyone
The fourth CVSS 10.0 flaw is in the SAML2 Service Provider component of SAP NetWeaver AS ABAP and ABAP Platform. The SP fails to properly verify the cryptographic signature of incoming authentication assertions under certain configurations. An attacker submits a crafted SAML assertion and the system accepts it, logging them in as any SAP user — including SAP_ADM and other privileged accounts.
This one has a wide blast radius: SAP_BASIS versions 702 through 920 are affected, covering a broad range of on-premises ABAP deployments. If your SAP system uses SAML2 for single sign-on, treat this as the same urgency as the ICM flaws.
- CVE-2026-120017 — NetWeaver AS ABAP / ABAP Platform SAML2 SP | SAP Note 3849308 | Affects SAP_BASIS 702–920
Patch Priority Order
| CVE | Component | SAP Note | Priority |
|---|---|---|---|
| CVE-2026-89126 | Web Dispatcher | 3778556 | First (internet-facing) |
| CVE-2026-76964 | NetWeaver ICM | 3772839 | Same kernel cycle |
| CVE-2026-89103 | SAP Gateway | 3760274 | Kernel + profile change |
| CVE-2026-120017 | ABAP Platform SAML2 | 3849308 | All SAP_BASIS 702–920 |
Five more notes in this release sit at CVSS 9.6–9.9, covering XXE in NetWeaver Knowledge Management, OS command injection in ABAP AS, broken access control in S4CRM, and two flaws in BusinessObjects. This is not a patch day to triage — apply everything.
Full technical breakdowns are available from BleepingComputer and The Hacker News. All 35 SAP Notes are available through the SAP Security Notes portal.
