SAP’s November Security Patch Day has fixed four flaws that need no login and that SAP rates at the maximum CVSS score of 10.0. Two of them, which researchers have named ICM2SHELL and ProxyGate, can give an attacker operating system access to the systems that run payroll, finance and supply chains across UK organisations.
What happened
SAP’s monthly Patch Day on 10 November 2026 brought 42 security notes, counting new and revised ones. Nine are rated critical, and four carry a CVSS score of 10.0. All four can be exploited by an attacker who has no account on the target system.
Onapsis researchers found three of the four. ICM2SHELL is one memory corruption bug that is tracked under two identifiers: CVE-2026-76964 in the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP, and CVE-2026-89126 in SAP Web Dispatcher. ProxyGate (CVE-2026-89103) is in SAP Gateway, the component that handles RFC traffic between SAP systems. The fourth, CVE-2026-120017, affects the SAML2 service provider in NetWeaver AS ABAP. On some configurations it lets an attacker sign in as any user, including privileged ones.
According to Onapsis, it handed SAP a functioning exploit for ICM2SHELL that needs no credentials. Onapsis says it has not seen either ICM2SHELL or ProxyGate exploited in the wild so far.
The technical picture
ICM2SHELL sits in SAP kernel code that reassembles fragmented WebSocket messages. The ICM and the Web Dispatcher share that code, so both are affected. According to the published analyses, malformed WebSocket frames cause memory to be written outside a heap buffer, all before authentication. The worst case is command execution as the <sid>adm user, meaning full control of the SAP instance; the best case is a crash. Onapsis says the denial of service reproduced on every kernel release it tested.
Three details make this worse than a typical kernel bug. First, WebSocket support is enabled out of the box, leaving systems vulnerable whether or not anything uses it. Second, Onapsis says some default S/4HANA ICF services accept WebSocket connections without authentication. Third, the Web Dispatcher is usually the component that faces the internet, and when it goes down, every system behind it goes down too. Embedded Web Dispatchers in SAP HANA XS are in scope; pure AS Java systems are not.
ProxyGate is a configuration problem as much as a code problem. According to Onapsis, exposure depends on the gateway’s proxy access list (prxyinfo). Where that file is missing, it depends on the profile parameter gw/acl_mode_proxy, which ships set to 0 and so permits every proxy connection. Most hardening guides focus on the secinfo and reginfo lists, not this one. If the proxy settings are permissive, crafted requests can persuade the gateway that an external attacker is a trusted application server in the same system, leading to commands run as <sid>adm. The kernel patch alone does not close the hole. Administrators also need a restrictive proxy list, or the parameter set to 1.
The SAML2 flaw is simpler and, in some ways, more worrying. In some setups, signatures on SAML assertions arriving at the service provider were never verified. There is no workaround, so applying the correction is the only fix.
Why it matters for UK organisations
SAP underpins finance, HR, procurement and logistics at many UK enterprises, public bodies and utilities, some of them in scope of the Cyber Security and Resilience Bill. A pre-authentication route to operating system access on an SAP server is about as serious as enterprise bugs get: the system usually holds a business’s most sensitive data and has trusted RFC links to many others.
Old kernels add to the risk. Onapsis names nine unsupported kernel releases, from 7.40 through to 7.89, that are vulnerable and may never be fixed. For ProxyGate, kernels 7.20 and 7.21 are on the list too. Organisations that have delayed an S/4HANA migration are the most likely to be on those releases. RISE with SAP customers should confirm with SAP who patches what; a separate FAQ note covers private cloud operations.
For regulated firms, the denial of service matters on its own. Taking a Web Dispatcher offline can halt customer-facing portals and supplier integrations, and that is the kind of disruption the FCA and PRA operational resilience rules expect firms to plan for.
Expert view
When we test SAP estates, the Web Dispatcher and the gateway are often the least-watched parts of the landscape. Basis teams patch the application layer to a schedule. Web Dispatchers get forgotten, especially standalone ones that someone set up years ago for a single portal. In my experience it is common to find one or two that nobody can account for. ICM2SHELL punishes that kind of drift: one missed instance leaves the bug exploitable.
ProxyGate repeats a lesson SAP security keeps teaching: shipped defaults are not secure defaults. A setting of 0 for gw/acl_mode_proxy, together with permissive or missing ACL files, is the sort of thing a configuration review should catch and often doesn’t.
A working exploit is in the vendor’s hands, and the advisories describe the vulnerable code paths, even though Onapsis has deliberately held back exploitation details. I would assume capable attackers can rebuild ICM2SHELL by diffing the fix, so the absence of exploitation today is no reason to wait.
What to do now
- Inventory first. List every Web Dispatcher, including standalone instances, embedded ones and those inside HANA XS, and every ABAP application server, along with its kernel release and patch level.
- Start with Web Dispatchers and ICMs exposed to the internet, then internal production, then everything else. Apply SAP Notes 3778530 and 3778556, and check FAQ note 3778788. On kernel 7.93, patch level 419 is still vulnerable: you need the updated 401 stack kernel, 402 when it is released, or 420 or later.
- Fix the Gateway configuration as well as the code. Apply note 3798345, then make the proxy list restrictive or set gw/acl_mode_proxy to 1. Firewall the gateway ports (33NN and 48NN) so that only hosts that need RFC can reach them. This is the Cyber Essentials firewall control applied to SAP.
- Apply the SAML2 fix (note 3849308) to any AS ABAP system that uses SAML for browser logon. Review the trusted identity providers in transaction SAML2, and check audit logs for privileged SAML logons from unexpected sources.
- Use stopgaps where you cannot patch yet. A patched Web Dispatcher can shield backends that nothing else can reach (not with PROT=ROUTER), or disable WebSocket upgrades after checking HTTP logs for 101 responses.
- Upgrade kernels that are out of maintenance. They may never get a fix. Cyber Essentials expects critical updates within 14 days and unsupported software removed, so treat these systems as non-compliant until they are upgraded.
- Monitor for unexpected ICM or Web Dispatcher restarts in dev_icm and dev_webdisp, and for unusual processes started by <sid>adm.
Bottom line
Four unauthenticated 10.0 flaws in the components at the edge of SAP landscapes demand urgent action. None is known to be exploited yet, but a working exploit exists and the affected code is now well described. UK SAP users should patch Web Dispatchers this week, tighten gateway ACLs and retire unsupported kernels.
