SAP's November 10 Security Patch Day bulletin rates four flaws in ICM, Web Dispatcher, SAP Gateway and the SAML2 service provider (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) at CVSS 10.0 [1]. According to The Hacker News, all four can be exploited without logging in; the ICM and Web Dispatcher flaws allow remote code execution and the SAML2 flaw allows logging in as any user on some systems using SAML single sign-on [2]. SAP customers should apply SAP Notes 3778530, 3778556, 3798345 and 3849308 from the support portal as a priority [1].
SAP November Patch Day fixes four CVSS 10.0 flaws letting unauthenticated attackers compromise NetWeaver and Web Dispatcher
1 min read
- Disclosed
- Nov 10, 2026
- Published
- Nov 10, 2026
- Last updated
- Nov 10, 2026
- CVSS basis
- Our assessment
- 0.4%, higher than 38% of CVEs
- Exploitation and patch status
- Patch available
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: SAP SAP NetWeaver AS ABAP (Internet Communication Manager), SAP SAP Web Dispatcher, SAP SAP Gateway, SAP SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
What to do nowOur advice
SAP customers should apply SAP Notes 3778530, 3778556, 3798345 and 3849308 from the support portal as a priority [1]
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| SAP SAP NetWeaver AS ABAP (Internet Communication Manager) | KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20[1] | SAP Note 3778530 | ✓ Patched |
| SAP SAP Web Dispatcher | HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, KERNEL 7.53–9.20[1] | SAP Note 3778556 | ✓ Patched |
| SAP SAP Gateway | KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22–9.21[1] | SAP Note 3798345 | ✓ Patched |
| SAP SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider) | SAP_BASIS 702–922[1] | SAP Note 3849308 | ✓ Patched |
Timeline
- SAP publishes November Security Patch Day notes[1]
- Onapsis dubs the ICM flaw ICM2SHELL and the Gateway flaw ProxyGate, says it gave SAP a working unauthenticated RCE exploit[3]
SecurityWeek reported on November 10 that Onapsis calls the ICM and Web Dispatcher flaw (CVE-2026-76964, CVE-2026-89126) ICM2SHELL and the SAP Gateway flaw (CVE-2026-89103) ProxyGate. Citing Onapsis, the report said its research labs gave SAP a working exploit achieving full unauthenticated remote code execution end to end, running arbitrary commands as <sid>adm, and that the denial-of-service condition reproduced on every SAP Kernel release tested. Onapsis also said ProxyGate sits in the SAP kernel and affects releases including kernel versions already out of maintenance. The report does not mention in-the-wild exploitation.
Technical details
Remediation
References
Official / primary1
- [1]
“SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape.”
Media2
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.