SAP Patches Critical ICM2SHELL and ProxyGate Vulnerabilities
Summary
SAP released security notes addressing nine critical vulnerabilities. Onapsis says ICM2SHELL enables unauthenticated command execution and that its research lab provided SAP a working exploit; ProxyGate may also enable unauthenticated RCE.
Key points
- SAP announced 42 new and updated security notes, including nine critical fixes; Onapsis separately counted 43 new and updated notes released that month.
- CVE-2026-76964 and CVE-2026-89126 affect the SAP kernel component handling HTTP, HTTPS and WebSocket traffic. Onapsis says crafted fragmented WebSocket messages can cause memory corruption or a crash.
- Onapsis says ICM2SHELL could allow unauthenticated operating-system command execution as <sid>adm. Its research lab provided SAP a working exploit, and it reproduced the denial-of-service condition on every SAP Kernel release it tested.
- CVE-2026-89103, called ProxyGate, affects SAP Gateway. The article says an open prxyinfo access-control list can let unauthenticated attackers send requests that appear to originate from a trusted internal network and execute OS commands.
- CVE-2026-120017 is a missing-authentication flaw that, in certain configurations, could let unauthenticated attackers impersonate arbitrary users.
- Other critical fixes cover NetWeaver, S4CRM, Web Dispatcher and BusinessObjects; SAP also released 17 high-severity fixes, including for memory corruption, denial-of-service and information-disclosure bugs.
Article Details
- Vulnerability Types
- Out-of-bounds memory write / memory corruption
- Access-control weakness involving the prxyinfo access-control list
- Missing authentication
- Severity
- Critical / maximum severity
- Exploitation Status
- unknown
- Exploit Availability
- claimed_or_private
- Patch Status
- available
- Workarounds
- For ProxyGate, restrict prxyinfo requests to trusted networks.
MITRE ATT&CK
CVE
CVE-2026-120017SAP_SE · SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)SAP also resolved a max-severity missing authentication bug in NetWeaver (CVE-2026-120017) that, in certain configurations, could allow unauthenticated attackers to submit specially crafted data and impersonateCVE-2026-76964SAP_SE · SAP NetWeaver AS ABAP (Internet Communication Manager)The ICM and Web Dispatcher flaws, tracked as CVE-2026-76964 and CVE-2026-89126, are a single weakness in the SAP kernel component that receives HTTP, HTTPS, and WebSocket traffic.CVE-2026-89103SAP_SE · SAP GatewayThe max-severity SAP Gateway flaw, tracked as CVE-2026-89103 and referred to as ProxyGate, could be exploited by unauthenticated attackers to achieve remote code execution (RCE) without user interaction.CVE-2026-89126SAP_SE · SAP Web DispatcherThe ICM and Web Dispatcher flaws, tracked as CVE-2026-76964 and CVE-2026-89126, are a single weakness in the SAP kernel component that receives HTTP, HTTPS, and WebSocket traffic.
Vendors
Products
GatewayFour of SAP’s new security notes address maximum-severity flaws in NetWeaver (Internet Communication Manager (ICM) and SAML2 Service Provider), Web Dispatcher, and Gateway.SAP KernelThe ICM and Web Dispatcher flaws, tracked as CVE-2026-76964 and CVE-2026-89126, are a single weakness in the SAP kernel component that receives HTTP, HTTPS, and WebSocket traffic.SAP NetWeaverFour of SAP’s new security notes address maximum-severity flaws in NetWeaver (Internet Communication Manager (ICM) and SAML2 Service Provider), Web Dispatcher, and Gateway.Web DispatcherFour of SAP’s new security notes address maximum-severity flaws in NetWeaver (Internet Communication Manager (ICM) and SAML2 Service Provider), Web Dispatcher, and Gateway.