cyber.hendryadrian.com
Security News · bleepingcomputer.com

SAP Fixes Four Maximum-Severity Flaws in November Security Update

· Original article ↗

Summary

SAP’s November 2026 updates fix 35 vulnerabilities, including four CVSS 10 flaws in NetWeaver, Gateway and Web Dispatcher that SAP says allow unauthenticated remote attackers to fully compromise systems. Onapsis tracks two as ICM2SHELL and PROXYGATE.

Key points

  • SAP patched 35 vulnerabilities in its November 2026 security updates, including four it rated maximum severity.
  • CVE-2026-76964 and CVE-2026-120017 affect NetWeaver Application Server ABAP components; the issues involve memory corruption and missing authentication.
  • CVE-2026-89103 is a broken access control flaw in SAP Gateway. Onapsis tracks it as PROXYGATE and describes it as pre-authentication remote code execution.
  • CVE-2026-89126 is a memory corruption flaw in SAP Web Dispatcher; Onapsis tracks it alongside CVE-2026-76964 as ICM2SHELL.
  • SAP says the four flaws are remotely exploitable by unauthenticated attackers and can allow full compromise of targeted systems.
  • Onapsis found and reported three of the four maximum-severity vulnerabilities.

Article Details

Event Type
SAP released its November 2026 security updates, patching 35 vulnerabilities, including four maximum-severity flaws.
Impact
SAP rated the four highlighted vulnerabilities 10/10 on the CVSS severity scale and said unauthenticated attackers could exploit them remotely to fully compromise affected systems. The flaws affect NetWeaver Application Server ABAP, SAP Gateway, and SAP Web Dispatcher. Onapsis described ICM2SHELL as enabling remote code execution and said PROXYGATE could expose business data, transaction integrity, and critical application availability.

CVE

CVE-2026-120017SAP_SE · SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components.CVE-2026-44756SAP_SE · SAP Extended Passport (EPP) Processingseverity flaws in September and October: a memory corruption flaw in the SAP Kernel code (tracked as CVE-2026-44756 and dubbed OVERPASS by Onapsis security researchers who reported it) and an OAuth2 SSRF vulnerabilityCVE-2026-58231SAP_SE · SAP Commerce Cloud (Data Hub Adapter)For instance, it patched CVE-2026-58231 in the Commerce Cloud cloud-based e-commerce platform in August, which threat intelligence firm Defused flagged as actively exploited in attacks days after the patch.CVE-2026-76964SAP_SE · SAP NetWeaver AS ABAP (Internet Communication Manager)The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components.CVE-2026-89103SAP_SE · SAP GatewayThe other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher.CVE-2026-89111SAP_SE · SAP Cloudwho reported it) and an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications (CVE-2026-89111).CVE-2026-89126SAP_SE · SAP Web DispatcherThe other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher.

Vendors

SAPSAP patches ICM2SHELL and PROXYGATE maximum severity flaws

Products

NetWeaver Application Server ABAPThe company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components.SAP Business Technology Platform (BTP)by Onapsis security researchers who reported it) and an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications (CVE-2026-89111).SAP Commerce CloudFor instance, it patched CVE-2026-58231 in the Commerce Cloud cloud-based e-commerce platform in August, which threat intelligence firm Defused flagged as actively exploited in attacks days after the patch.SAP GatewayThe other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher.SAP KernelIt also addressed two more max severity flaws in September and October: a memory corruption flaw in the SAP Kernel code (tracked as CVE-2026-44756 and dubbed OVERPASS by Onapsis security researchers who reported it) andSAP Web DispatcherThe other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher.

Related Articles