SAP patches ICM2SHELL and PROXYGATE maximum severity flaws

ICM2SHELL

SAP's November 2026 security updates addressed a critical set of vulnerabilities, notably including those collectively tracked as ICM2SHELL by cybersecurity firm Onapsis. This designation covers a memory corruption flaw (CVE-2026-76964) in the NetWeaver Application Server ABAP's Internet Communication Manager and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher. Both flaws are rated 10/10 on the CVSS severity scale, indicating the highest possible risk level for affected systems. The NetWeaver platform is the foundational application server underpinning SAP's vast suite of business software, responsible for critical functions like application integration, authentication, user management, and data processing. Similarly, the Web Dispatcher acts as a load balancer and reverse proxy, deployed in almost every enterprise SAP environment to manage incoming web requests.

The significance of ICM2SHELL lies in its ability to transform routine web traffic into a direct point of ingress for attackers. Onapsis explicitly stated that these vulnerabilities enable remote code execution against network-facing components without requiring any SAP user credentials, passwords, or user interaction. This means an attacker could gain complete control over critical parts of the SAP infrastructure, which is designed to handle the core business processes for 99 of the 100 largest companies worldwide. The ease of exploitation and the broad impact on fundamental SAP components make ICM2SHELL a particularly dangerous threat, necessitating immediate patching by all affected organizations to prevent unauthorized access and system compromise.

PROXYGATE

Another maximum-severity vulnerability addressed in the same patch cycle is PROXYGATE, identified as a broken access control weakness (CVE-2026-89103) in SAP Gateway. This flaw also received a 10/10 CVSS score due to its potential for severe impact on enterprise systems. SAP Gateway serves as a crucial framework, enabling external applications to securely connect with SAP backend systems, making its compromise particularly dangerous for data integrity and system security. The vulnerability allows an attacker to bypass authentication mechanisms and gain unauthorized access to the system.

PROXYGATE operates by tricking the SAP Gateway into believing that an unauthenticated, external attacker is a legitimate internal application server. Similar to ICM2SHELL, this exploit requires no SAP user, no password, and no user interaction, yet it grants full control of the SAP system under the account that owns the installation. For production ERP systems, this translates to direct exposure of sensitive business data, compromise of transaction integrity, and potential unavailability of critical business applications. The ability to achieve full system control without any prior authentication makes PROXYGATE an extremely potent threat, capable of causing widespread disruption and data exfiltration if left unpatched.

Onapsis

The cybersecurity firm Onapsis played a pivotal role in identifying and reporting three of the four maximum-severity issues patched by SAP in November 2026, including those dubbed ICM2SHELL and PROXYGATE. Their research and disclosure efforts are crucial for enhancing the security posture of SAP's extensive global customer base, which includes many of the world's largest corporations. Onapsis's detailed analysis highlighted the severe implications of these flaws, emphasizing the ease with which unauthenticated attackers could achieve full remote system compromise, thereby providing critical intelligence for SAP and its users.

This round of patches is not an isolated incident but part of a recurring pattern of maximum-severity flaws in SAP components. The article notes other recent critical fixes, such as CVE-2026-58231 in Commerce Cloud, which was actively exploited shortly after its patch, and CVE-2026-44756 (OVERPASS) in SAP Kernel. The US Cybersecurity and Infrastructure Security Agency (CISA) has also flagged 14 SAP security flaws as actively exploited since November 2021, with three of these being abused by ransomware groups. This history underscores the persistent threat landscape surrounding SAP systems and the critical importance of prompt patching by organizations to mitigate the risk of sophisticated cyberattacks and data breaches. The continuous discovery and patching of such critical vulnerabilities highlight the ongoing cat-and-mouse game between security researchers, vendors, and malicious actors in the enterprise software ecosystem.