SAP patches CVSS 10.0 PROXYGATE and ICM2SHELL flaws
Original title: Hackers Can Exploit SAP PROXYGATE and ICM2SHELL Flaws for Unauthorized Full System Access
Onapsis found no exploitation; network attackers can run commands as the SAP installation owner, <sid>adm.
SAP released November 10, 2026 Security Patch Day fixes for PROXYGATE and ICM2SHELL, both scored CVSS 10.0. Onapsis Research Labs found the flaws let attackers with network access run operating-system commands as the SAP <sid>adm account. PROXYGATE, CVE-2026-89103, can bypass locked-down secinfo and reginfo lists when proxy policy is permissive. ICM2SHELL covers WebSocket memory corruption in Internet Communication Manager and SAP Web Dispatcher. Onapsis reported no observed exploitation.
Unconfirmed: Onapsis reported no observed exploitation, which it says does not prove every environment is safe.
- Most affected kernels also need gw/acl_mode_proxy set to 1 and tighter prxyinfo rules.
- WebSocket support is on by default; some S/4HANA services need no login.
- ICM2SHELL is addressed in Security Notes 3778530 and 3778556.
- Command execution does not automatically grant root on the server.
Impact: Unauthenticated OS command execution as the SAP <sid>adm account
| Product | Affected |
|---|---|
| SAP Gateway | — |
| SAP Internet Communication Manager | — |
| SAP Web Dispatcher | including SAP HANA XS |
- 1.Apply the relevant kernel update and set gw/acl_mode_proxy = 1.
- 2.Restrict permissive prxyinfo rules and limit Gateway access to required hosts.
- 3.Install Security Notes 3778530 and 3778556, then verify ICM and Web Dispatcher.
- Vendors
- SAP
- Organizations
- Onapsis Research Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76964 | Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP | 10.0 | — | ||
| CVE-2026-89103 | Incorrect authorization via SAP Gateway default ACL | 10.0 | — | ||
| CVE-2026-89126 | Unauthenticated memory corruption in SAP Web Dispatcher | 10.0 | — |
From the original article
3 min read at cybersecuritynews.com
SAP has released fixes for PROXYGATE and ICM2SHELL, critical security flaws that could let attackers take control of SAP systems without signing in. Disclosed during the November 10, 2026, Security Patch Day, the vulnerabilities carry maximum CVSS scores of 10. 0 and affect core components used across business applications.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.