SAP patches critical ICM2SHELL and ProxyGate kernel flaws
Original title: SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities
Onapsis gave SAP a working unauthenticated exploit for ICM2SHELL; the November notes also cover ProxyGate and a SAML impersonation bug.
SAP released 42 new and updated security notes, nine of them critical, including four maximum-severity issues in NetWeaver, Web Dispatcher, and Gateway. Onapsis says ICM2SHELL, CVE-2026-76964 and CVE-2026-89126, is a WebSocket reassembly flaw that can crash the process or run OS commands as <sid>adm, and that its labs gave SAP a working unauthenticated exploit. ProxyGate, CVE-2026-89103, can yield the same result if the prxyinfo ACL is left open. A separate missing-authentication bug, CVE-2026-120017, can let attackers impersonate users in some configurations.
Unconfirmed: Onapsis says it gave SAP a working exploit; the notes do not say attackers are exploiting the flaws.
- ICM2SHELL affects the SAP kernel component handling HTTP, HTTPS, and WebSocket traffic.
- Onapsis says denial of service reproduced on every SAP Kernel release it tested.
- ProxyGate also affects out-of-maintenance kernels on ABAP, AS Java, dual-stack, and standalone gateways.
- Five more critical notes cover NetWeaver, S4CRM, Web Dispatcher, and BusinessObjects.
- SAP also issued 17 high-severity fixes for memory corruption, DoS, and information disclosure.
Impact: Unauthenticated remote code execution as <sid>adm
| Product | Affected |
|---|---|
| SAP NetWeaver Internet Communication Manager | — |
| SAP Web Dispatcher | — |
| SAP Gateway | broad range of kernel releases, including out of maintenance |
| SAP NetWeaver SAML2 Service Provider | certain configurations |
- 1.Apply SAP’s November 2026 security notes covering the critical kernel flaws.
- 2.Restrict the prxyinfo access-control list to trusted networks only.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109795 | Code injection in SAP NetWeaver remote functionality | 9.9 | — | ||
| CVE-2026-109798 | Authenticated XXE in SAP BusinessObjects Web Intelligence | 9.1 | — | ||
| CVE-2026-109803 | Authenticated code injection via XSL in SAP NetWeaver KM | 9.9 | — | ||
| CVE-2026-120017 | Authentication bypass in SAP NetWeaver AS ABAP under some configs | 10.0 | — | ||
CVE-2026-76964+1 related CVE | Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP | 10.0 group max | — | ||
| CVE-2026-89103 | Incorrect authorization via SAP Gateway default ACL | 10.0 | — | ||
CVE-2026-89126+1 related CVE | Unauthenticated memory corruption in SAP Web Dispatcher | 10.0 group max | — |
From the original article
2 min read at securityweek.com
SAP has published 42 new and updated security advisories, including nine that address critical-severity vulnerabilities. The post SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.