SAP patches four unauthenticated CVSS 10 flaws
November 10: Onapsis says attackers can run commands as <sid>adm, PROXYGATE can bypass locked secinfo and reginfo if proxy policy is permissive, and exploitation was not observed.
SAP’s November 10, 2026 patches fix four unauthenticated CVSS 10.0 flaws; Onapsis reports no exploitation.
SAP’s November 10, 2026 Security Patch Day fixes 35 vulnerabilities, including four unauthenticated flaws rated CVSS 10.0 that need no user interaction. Memory-corruption bugs in Internet Communication Manager (CVE-2026-76964) and Web Dispatcher (CVE-2026-89126), which Onapsis calls ICM2SHELL, can let a network attacker run code. A SAML 2.0 Service Provider flaw (CVE-2026-120017) can allow login as any user on some single sign-on systems. PROXYGATE (CVE-2026-89103) is a Gateway access-control flaw that, according to Onapsis, can let attackers run operating-system commands as the SAP <sid>adm account and bypass locked-down secinfo and reginfo lists when proxy policy is permissive. Onapsis, which reported three of the four, says it has not observed exploitation; SAP recommends applying the notes as a priority.
- November updates fix 35 vulnerabilities, four rated CVSS 10.0.
- ICM CVE-2026-76964 is fixed in Note 3778530; Web Dispatcher CVE-2026-89126 in Note 3778556.
- Gateway CVE-2026-89103 is fixed in Note 3798345, with no listed workaround.
- SAML2 CVE-2026-120017 is fixed in Note 3849308 for listed SAP_BASIS releases.
- Onapsis says command execution as <sid>adm does not automatically grant root.
- Many affected kernels also need gw/acl_mode_proxy set to 1 and tighter prxyinfo rules.
Timeline
dated events in the reporting · oldest first- Nov 10, 2026SAP releases Security Patch Day fixes for the four flaws · Cyber Security News
What each outlet adds
beyond the shared facts- The Hacker NewsMaps each flaw to its SAP security note and RedRays rollout advice.
- BleepingComputerCounts 35 November fixes and says Onapsis reported three issues.
- Cyber Security NewsDetails <sid>adm command execution, proxy ACL bypass, and no root grant.
Coverage
oldest first · one row per article · UTC- · 1d ago
SANS Internet Storm CenterFirst report
Honeypot sees scans for SAP NetWeaver webshells via CVE-2025-31324
SANS logged requests for ant.jsp and other upload paths, including an unauthenticated upload bug scored CVSS 10.
- · 15h ago
The Hacker News
SAP patches four CVSS 10.0 flaws, including unauthenticated RCE
The November fixes cover NetWeaver ICM, Web Dispatcher, Gateway, and SAML, and none require user interaction.
- · 13h ago
BleepingComputer
SAP patches four CVSS 10 flaws in NetWeaver, Gateway and Web Dispatcher
Onapsis names the memory-corruption bugs ICM2SHELL and the Gateway pre-auth issue PROXYGATE; attacks on these four are not reported.
- · 8h ago
Cyber Security News
SAP patches CVSS 10.0 PROXYGATE and ICM2SHELL flaws
Onapsis found no exploitation; network attackers can run commands as the SAP installation owner, <sid>adm.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-31324 | Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2026-120017 | Authentication bypass in SAP NetWeaver AS ABAP under some configs | 10.0 | — | ||
| CVE-2026-76964 | Unauthenticated memory corruption RCE in SAP NetWeaver AS ABAP | 10.0 | — | ||
| CVE-2026-89103 | Incorrect authorization via SAP Gateway default ACL | 10.0 | — | ||
| CVE-2026-89126 | Unauthenticated memory corruption in SAP Web Dispatcher | 10.0 | — |