SAP fixed 35 vulnerabilities in its November Security Patch Day, four of them rated the maximum CVSS score of 10.0, including two flaws that give an unauthenticated attacker remote code execution on SAP web-facing components.
Onapsis, the SAP security firm, discovered three of the four critical bugs, and researchers have demonstrated proof-of-concept exploits. No exploitation in the wild has been reported.
ICM2SHELL: Malformed WebSocket Frames Corrupt Memory in Two SAP Components
The pair of flaws that researchers call “ICM2SHELL” are CVE-2026-76964, which affects the Internet Communication Manager in SAP NetWeaver Application Server ABAP, and CVE-2026-89126, which affects SAP Web Dispatcher. Both involve memory corruption triggered by malformed WebSocket frames. An attacker who sends such frames can achieve remote code execution without authenticating.
Both components sit at the network edge of SAP landscapes, handling inbound HTTP and WebSocket traffic. A flaw that needs no credentials and no user interaction in that position is the combination that earns a 10.0 rating.
Out-of-Maintenance Kernel Versions Are Also Exposed
The advisories note that kernel versions outside standard maintenance are also affected. Organizations running older kernels cannot assume they fall outside the scope of the fixes, and will need to move to a supported kernel level to receive the correction.
PROXYGATE and the SAML2 Authentication Gap
The third maximum-severity bug, dubbed “PROXYGATE” and tracked as CVE-2026-89103, is a broken access control flaw in SAP Gateway. An external attacker can be treated by the system as one of its own application servers. That trust confusion gives the attacker full control of the system as the installation owner account.
CVE-2026-120017 Lets Attackers Log In as Any User
The fourth flaw, CVE-2026-120017, is a missing authentication issue in the SAML2 Service Provider. On systems that use SAML single sign-on, it lets an attacker log in as any user. Single sign-on bugs of this type are especially consequential because the identity layer is the control that other protections depend on.
Taken together, the four flaws cover three distinct failure modes: memory corruption at the edge, trust confusion between servers, and absent authentication in the login flow. Each leads to an outcome that security teams treat as a full compromise of the affected SAP system.
Why SAP Flaws Draw Sustained Attacker Interest
SAP software runs core financial, supply-chain and HR processes at most large enterprises, which makes it a valuable target. CISA currently tracks 14 SAP vulnerabilities as exploited in the wild since November 2021, according to its catalog. That history frames the new disclosures: SAP bugs do get weaponized, and a publicly demonstrated proof of concept shortens the time before attackers try.
The absence of observed exploitation is a snapshot, not a guarantee. When researchers publish working demonstrations of unauthenticated remote code execution, defenders generally treat the window between disclosure and first attack as short, though the exact interval varies from case to case.
Patching Priorities for SAP Administrators
SAP has released patches and updated components. Administrators will need to apply kernel updates as well as component fixes, since the Internet Communication Manager and Web Dispatcher flaws live in the kernel and dispatcher layers. Teams that expose SAP Web Dispatcher or the Internet Communication Manager to untrusted networks have the clearest reason to move quickly.
For organizations unable to patch immediately, reviewing which SAP interfaces are reachable from the internet is the logical first step, because both ICM2SHELL flaws need only network access to the vulnerable service.
Where the Four SAP Maximum-Severity Flaws Differ in Attack Preconditions
The four flaws do not share one attack path. ICM2SHELL needs only the ability to send malformed WebSocket frames to the Internet Communication Manager or Web Dispatcher. PROXYGATE depends on the Gateway accepting an external party as one of the system’s own application servers. CVE-2026-120017 applies specifically to systems configured for SAML single sign-on.
That difference affects triage. An SAP landscape that does not use SAML SSO is outside the scope of the fourth flaw, while one that exposes Web Dispatcher to the internet has the clearest exposure to the first two. Security teams can use that mapping to decide the order of patching, though the advisories’ maximum scores argue for fixing all four.
