SAP patches four CVSS 10.0 flaws, including unauthenticated RCE
The November fixes cover NetWeaver ICM, Web Dispatcher, Gateway, and SAML, and none require user interaction.
Stories per day · 30 days
2 RSS
Relatedsap6netweaver5sap-gateway4icm2shell3proxygate3patch-day2remote-code-execution2saml2businessobjects1
7 stories, newest first · one card per story
Stories tagged #web-dispatcher
SAP patches critical ICM2SHELL and ProxyGate kernel flaws
Onapsis gave SAP a working unauthenticated exploit for ICM2SHELL; the November notes also cover ProxyGate and a SAML impersonation bug.
SAP November 2026 notes fix four CVSS 10.0 unauthenticated flaws
The bulletin lists 35 new notes and does not report active exploitation of the patched issues.
SAP November patch day fixes four CVSS 10.0 flaws
Unauthenticated memory corruption in ICM and Web Dispatcher may allow code execution; exploitation is not discussed.
CVE-2026-44756: Pre-Auth RCE in SAP EPP Processing (ICM, Web Dispatcher, disp+work)
nullFaktor disclosed pre-authentication remote code execution in SAP EPP processing, tracked as critical CVE-2026-44756.
SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport
SAP's September 2026 Patch Day fixes 19 notes including CVE-2026-44756 (CVSS 10.0), unauthenticated memory corruption in SAP Extended Passport Processing kernels.
3
SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws
SAP's September 2026 Patch Tuesday ships 19 security notes, including four criticals led by a CVSS 10.0 memory-corruption flaw in Extended Passport Processing.
4