SAP patches unauthenticated PROXYGATE and ICM2SHELL flaws
Original title: Critical SAP PROXYGATE and ICM2SHELL Vulnerabilities Allow Server Takeover Without Authentication
Three CVSS 10.0 flaws can run OS commands as <sid>adm; Onapsis reported no in-the-wild exploitation.
SAP patched three critical flaws grouped as PROXYGATE and ICM2SHELL, all scored CVSS 10.0, after Onapsis Research Labs disclosed them on November 10, 2026. CVE-2026-89103 bypasses SAP Gateway trust checks through the proxy policy. CVE-2026-76964 and CVE-2026-89126 are memory overflows in Internet Communication Manager and Web Dispatcher WebSocket handling, including the dispatcher in SAP HANA XS. Onapsis saw no exploitation in the wild and withheld exploit details after giving SAP a working exploit.
Unconfirmed: Onapsis reported no in-the-wild exploitation at publication; permissive proxy rules can remain dangerous after patching.
- PROXYGATE needs no SAP account; secinfo and reginfo hardening do not stop it.
- A missing prxyinfo file with gw/acl_mode_proxy=0 permits proxy access.
- Notes 3798345, 3778530 and 3778556 describe remediation.
- WebSocket support is enabled by default even when unused.
- Repeated crashes can keep services behind a dispatcher unavailable.
Impact: unauthenticated OS command execution as <sid>adm
| Product | Affected |
|---|---|
| SAP Gateway | — |
| SAP Internet Communication Manager | — |
| SAP Web Dispatcher | — |
- 1.Apply SAP Notes 3798345, 3778530 and 3778556, including kernel updates.
- 2.Set gw/acl_mode_proxy=1 and restrict gateway ports 33NN/48NN.
- 3.Patch internet-facing servers and investigate unexpected ICM or dispatcher restarts.
- Vendors
- SAP
- Organizations
- Onapsis Research Labs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76964 | Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP | 10.0 | — | ||
| CVE-2026-89103 | Incorrect authorization via SAP Gateway default ACL | 10.0 | — | ||
| CVE-2026-89126 | Unauthenticated memory corruption in SAP Web Dispatcher | 10.0 | — |
From the original article
2 min read at gbhackers.com
SAP has patched three critical vulnerabilities, grouped as PROXYGATE and ICM2SHELL, that let attackers take control of affected SAP systems without authentication. Discovered by Onapsis Research Labs and disclosed on November 10, 2026, all three carry CVSS scores of 10. 0.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.