SAP November 2026 patch day: ICM2SHELL, PROXYGATE and two more CVSS 10.0 flaws fixed

SAP's November 2026 Security Patch Day, released on 10 November, fixes four vulnerabilities rated CVSS 10.0, the maximum score: CVE-2026-76964 and CVE-2026-89126 (together called ICM2SHELL), CVE-2026-89103 (PROXYGATE) and CVE-2026-120017, a missing-authentication flaw in the SAML2 service provider of SAP NetWeaver AS ABAP. Security firm Onapsis, which reported three of the four, says it has not seen any of them exploited so far, but two of the flaws need no login at all, and the fix for PROXYGATE needs a manual configuration step after the patch is installed.

Key points

• SAP's patch day page for 10 November 2026 lists 35 new security notes, 4 GitHub security advisories and 3 updates to earlier notes; nine entries are rated Critical (Hot News).
• Four notes score CVSS 10.0: 3778530 (CVE-2026-76964), 3778556 (CVE-2026-89126), 3798345 (CVE-2026-89103) and 3849308 (CVE-2026-120017).
• ICM2SHELL is a memory corruption bug in WebSocket handling shared by the SAP Internet Communication Manager (ICM) and the SAP Web Dispatcher; Onapsis says it can lead to operating-system command execution as the <sid>adm user.
• PROXYGATE (CVE-2026-89103) lets an outside attacker pass as an internal application server to the SAP Gateway; the shipped default gw/acl_mode_proxy = 0 leaves systems with no restrictive prxyinfo file exposed.
• Onapsis said on 10 November it had not observed exploitation of ICM2SHELL or PROXYGATE in the wild.

What to do

Who is affected. Any SAP system running an affected kernel. For ICM2SHELL, Onapsis says that means SAP NetWeaver AS ABAP on kernel 7.40 or later and any SAP Web Dispatcher, including the one embedded in SAP HANA XS; AS Java alone is not affected and kernel 7.22 is not affected. For PROXYGATE the flaw is in the kernel's gateway, so ABAP, AS Java, dual-stack and standalone gateways can all be affected.

Fixed kernel patch levels (ICM2SHELL, per Onapsis): kernel and Web Dispatcher 7.53 PL 1616 or 1617, 7.54 PL 710, 7.77 PL 914, 7.93 PL 401 or 420 (PL 419 is still affected), 9.16 PL 111, 9.18 PL 37, 9.20 PL 11 or 13; HANA DB 2.0 revisions 2.00.079.11 and 2.00.089.05; SAP EAS 1.0 SP05 patch 4.

Fixed kernel patch levels (PROXYGATE, per Onapsis): 7.22 EXT, EX2 and EX3 PL 1612, 7.53 PL 1625, 7.54 PL 718, 7.77 PL 915, 8.04 PL 244, 9.20 PL 16, 9.21 PL 4. Kernels 7.93 and 9.16 already support the parameter, so setting gw/acl_mode_proxy = 1 is enough there.

Steps, in order of urgency:

1. Find every gateway and Web Dispatcher that can be reached from outside the SAP network, including non-production systems and standalone Web Dispatchers, and put them first.
2. For PROXYGATE, check whether a prxyinfo file exists and what it allows. A permissive file (for example P SOURCE=* DEST=*) means the system is vulnerable. With no file, gw/acl_mode_proxy = 0 means vulnerable and 1 means protected, provided the kernel supports the parameter. Restrict prxyinfo to trusted sources and destinations now, then apply the kernel patch from note 3798345 and set the parameter on every application server.
3. For ICM2SHELL, compare each kernel's release and patch level with the table above and apply notes 3778530 and 3778556.
4. If you cannot patch yet, Onapsis lists two temporary measures for ICM2SHELL: put a patched Web Dispatcher in front of backends that are reachable only through it (it does not help if backends are directly reachable), or set icm/HTTP/support_websocket_upgrade=FALSE and restart. Check HTTP logs for status 101 responses first, because disabling WebSocket can break interactive and integration scenarios, and Onapsis's patch-day post advises against relying on it.
5. Kernels that are out of maintenance (7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 for ICM2SHELL, plus 7.20, 7.21 and others for PROXYGATE) are affected and may not get a fix. They have to be upgraded.
6. Watch dev_icm and dev_webdisp for unexpected restarts.

What happened

SAP publishes security notes on the second Tuesday of each month. The 10 November page lists 35 new notes, four advisories on GitHub (for SAP's open-source and cloud SDK components) and three updates to older notes. Counting what the page shows, that is nine Critical entries, 17 High, 15 Medium and one Low.

The four CVSS 10.0 entries are:

• Note 3778530, CVE-2026-76964: memory corruption in SAP NetWeaver AS ABAP (Internet Communication Manager).
• Note 3778556, CVE-2026-89126: memory corruption in SAP Web Dispatcher.
• Note 3798345, CVE-2026-89103: broken access control in SAP Gateway.
• Note 3849308, CVE-2026-120017: missing authentication in the SAML2 service provider of SAP NetWeaver AS ABAP and ABAP Platform, affecting SAP_BASIS releases from 702 through 922.

Five more Critical notes follow, from CVSS 9.9 down to 9.1: code injection in NetWeaver Knowledge Management XML Forms (CVE-2026-109803), OS command injection in the ABAP application server (CVE-2026-76965), a missing authorization check in S4CRM (CVE-2026-109795), a cross-site request forgery in the Web Dispatcher and ICM (CVE-2026-89119, with CVE-2026-120014) and an XXE flaw in BusinessObjects Web Intelligence (CVE-2026-109798).

BleepingComputer reports that Onapsis found and reported three of the four maximum-severity issues. It quotes Onapsis as saying ICM2SHELL gives remote code execution with "no SAP user, no password and no user interaction."

Background

Maximum-severity SAP kernel bugs are not rare this year. BleepingComputer's report recalls CVE-2026-44756 (called OVERPASS by Onapsis, a kernel memory corruption flaw patched in September), an OAuth2 server-side request forgery in October (CVE-2026-89111) and CVE-2026-58231 in SAP Commerce Cloud, which attackers began exploiting days after the August patch, according to that report. The same report says CISA has flagged 14 SAP flaws as exploited since November 2021, three of which ransomware groups used.

The Commerce Cloud case shows how fast it can move: exploitation was reported within days of the patch.

How it works

The two bugs behind the headline names work differently.

ICM2SHELL. Onapsis says the flaw sits in how the SAP kernel reassembles fragmented WebSocket messages, code shared by the ICM and the Web Dispatcher. A crafted sequence of messages writes data past the memory reserved for a connection. The result is either a crash of the process or controlled memory corruption that can lead to command execution as <sid>adm. WebSocket support is on by default even if no application uses it, and some default ICF services in SAP S/4HANA accept WebSocket connections without authentication. All an attacker needs is network access to the HTTP or HTTPS port.

PROXYGATE. Onapsis says the gateway's CPI-C layer can be manipulated so that an external request looks like one from an internal application server. The access control lists then approve it, and the gateway can start an operating-system command chosen by the attacker, again as <sid>adm. The proxy access list, prxyinfo, is the deciding control. Hardening secinfo or reginfo does not remove the exposure, according to Onapsis. Because the fix is a kernel patch plus a parameter, installing only the patch is not enough.

High17

Medium15

Critical (Hot News)9

Low1

Entries on SAP's 10 November 2026 patch day page, by priority (entries)

	entries
High	17
Medium	15
Critical (Hot News)	9
Low	1

Source: SAP Security Patch Day, November 2026

What it means

For SAP administrators the order of work is set by exposure, not by score alone: every note above is rated critical or high, but a Web Dispatcher or gateway reachable from the internet, or from a flat internal network, is a different risk from a system behind strict network rules. The PROXYGATE fix being two-step is a classic place where a system ends up half-protected, patched in the change ticket but still on the default parameter.

For security teams, the main shift is that the entry point is ordinary web and RFC traffic, not an unusual service. Onapsis notes that older kernels will not be fixed, so organisations still running them face a platform upgrade rather than a patch, and that is a project with a lead time, not a weekend change.

For SAP customers on RISE with SAP, Onapsis points to a separate note, 3849055, a private cloud operations FAQ, so check with your operations provider about who applies the kernel updates.

Onapsis says 14 of the 36 vulnerabilities it supported this month were found with XBOW, an AI-driven testing tool. We have not verified that figure beyond Onapsis's own post.

What we don't know yet

• Exploitation. Onapsis reports none observed as of 10 November. BleepingComputer's article does not say either way. Neither statement rules out attacks Onapsis cannot see.
• Counts differ by source. SAP's page, as we read it, lists nine Critical entries among 35 new notes, 4 GitHub advisories and 3 updates. Onapsis's own summary counts 43 new and updated notes including 12 HotNews and 13 High priority, and calls it a record. We could not reconcile the difference, which may come from how updated notes and cloud components are counted.
• Detail of the SAML2 bug. Onapsis describes note 3849308 only as an authentication bypass "under certain configurations" that could let an attacker impersonate users, including privileged ones. The conditions are not public in the sources we read.
• Proof of concept. Onapsis says it omits technical exploitation details. Whether others will publish them is not known.

What to watch next

Watch for a CISA Known Exploited Vulnerabilities entry for any of these CVEs and for public exploit code. Watch for the second patch level on kernel 7.93 (PL 402), which Onapsis says is still to come. Next patch day is the second Tuesday of December, and SAP Security Notes can change after release, so recheck the notes you applied.

Sources

• SAP Security Patch Day, November 2026 (primary)
• Onapsis: ICM2SHELL threat advisory
• Onapsis: PROXYGATE threat advisory
• Onapsis: SAP Security Notes, November 2026 Patch Day
• BleepingComputer: SAP patches four maximum severity security vulnerabilities