SAP patches four CVSS 10 flaws in NetWeaver, Gateway and Web Dispatcher
Original title: SAP patches ICM2SHELL and PROXYGATE maximum severity flaws
Onapsis names the memory-corruption bugs ICM2SHELL and the Gateway pre-auth issue PROXYGATE; attacks on these four are not reported.
SAP's November 2026 updates fix 35 vulnerabilities, including four rated 10/10 in NetWeaver Application Server ABAP, Web Dispatcher, and SAP Gateway. CVE-2026-76964 and CVE-2026-89126 are memory-corruption issues; CVE-2026-120017 is missing authentication in the SAML2 Service Provider; CVE-2026-89103 is broken access control in Gateway. Onapsis, which reported three of them, says unauthenticated attackers can get remote code execution or control as the installation owner. The article does not report in-the-wild use of these four flaws.
Unconfirmed: The article does not say whether the four November flaws are being exploited.
- Thirty-five vulnerabilities were fixed in the November 2026 SAP security updates.
- CVE-2026-76964 affects Internet Communication Manager; CVE-2026-89126 affects Web Dispatcher.
- CVE-2026-120017 is missing authentication in the SAML2 Service Provider.
- Onapsis reported three of the four maximum-severity issues.
- CISA has flagged 14 older SAP flaws as exploited since November 2021.
Impact: Unauthenticated remote full compromise of targeted SAP systems
| Product | Affected |
|---|---|
| SAP NetWeaver Application Server ABAP Internet Communication Manager | — |
| SAP NetWeaver SAML2 Service Provider | — |
| SAP Gateway | — |
| SAP Web Dispatcher | — |
- 1.Apply SAP's November 2026 security updates for NetWeaver, Gateway, and Web Dispatcher.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120017 | Authentication bypass in SAP NetWeaver AS ABAP under some configs | 10.0 | — | ||
| CVE-2026-76964 | Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP | 10.0 | — | ||
| CVE-2026-89103 | Incorrect authorization via SAP Gateway default ACL | 10.0 | — | ||
| CVE-2026-89126 | Unauthenticated memory corruption in SAP Web Dispatcher | 10.0 | — |
From the original article
2 min read at bleepingcomputer.com
SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.