SAP Patches Critical ICM2SHELL and ProxyGate Vulnerabilities

SAP has released 42 security advisories to address a series of critical and high-severity vulnerabilities, including two significant flaws that could allow unauthenticated attackers to gain full control over affected systems.

The vulnerabilities, which include the “ICM2SHELL” defect and the “ProxyGate” flaw, were highlighted by researchers at Onapsis. The security updates target several core components, including NetWeaver, Web Dispatcher, and the SAP Gateway.

Critical Remote Code Execution Flaws

The ICM2SHELL vulnerability, tracked as CVE-2026-76964 and CVE-2026-89126, affects the SAP kernel component responsible for processing HTTP, HTTPS, and WebSocket traffic. The flaw is related to how the system reassembles large WebSocket messages that are split into fragments during transmission.

According to Onapsis, a specially crafted sequence of WebSocket messages can cause the Internet Communication Manager (ICM) or Web Dispatcher to write attacker-controlled data beyond the memory reserved for the connection. This can result in an immediate process crash or controlled memory corruption. Researchers demonstrated that the flaw allows for full, unauthenticated remote code execution (RCE), enabling an attacker to run arbitrary commands with <sid>adm privileges on the target system.

A second maximum-severity flaw, referred to as ProxyGate (CVE-2026-89103), impacts the SAP Gateway. The issue involves the prxyinfo access-control list, which is designed to restrict requests to trusted internal networks. If left open, the flaw allows attackers to send a series of requests that appear to originate from an internal network, effectively bypassing security restrictions.

This bypass enables unauthenticated attackers to execute operating system commands with <sid>adm privileges, granting full control over the SAP system without the need for a username, password, or certificate. Because the flaw exists within the SAP kernel, it affects a broad range of releases, including kernel versions that are no longer under active maintenance. The vulnerability impacts ABAP, AS Java, dual-stack, and standalone-gateway systems.

Authentication and Identity Risks

SAP also addressed a maximum-severity missing authentication bug in NetWeaver (CVE-2026-120017). In certain configurations, this vulnerability could allow unauthenticated attackers to submit specially crafted data to impersonate arbitrary users, potentially leading to complete system compromise.

The November 2026 security bulletin includes five additional critical notes addressing vulnerabilities in S4CRM, BusinessObjects, Web Dispatcher, and NetWeaver. Additionally, SAP published 17 high-severity fixes for various memory corruption, denial-of-service (DoS), and information disclosure bugs.

The update also includes new security notes concerning the recently disclosed PHP2Shell and Node2Shell vulnerabilities within the SAP Business AI Platform. Organisations running SAP services are advised to review the relevant security notes and apply the necessary patches immediately to mitigate these risks.