SAP patches ICM2SHELL, PROXYGATE and SAML2 authentication bypass flaws

Threat summary

On November 10, 2026, SAP released 35 new security notes as part of its November Security Patch Day. Four of the vulnerabilities were rated with Common Vulnerability Scoring System (CVSS) scores of 10.0, including:

• CVE-2026-76964

• CVE-2026-89126

• CVE-2026-89103

• CVE-2026-120017

Onapsis, which reported three of the vulnerabilities, published technical advisories the same day and named the flaws ICM2SHELL and PROXYGATE.

CVE-2026-76964 and CVE-2026-89126 (ICM2SHELL)

CVE-2026-76964 and CVE-2026-89126 affect the components that handle web traffic in SAP environments: the Internet Communication Manager (ICM) and SAP Web Dispatcher. A flaw in how these components process WebSocket traffic allows a remote, unauthenticated threat actor with network access to execute code or cause a service disruption.

Affected deployments include:

• SAP NetWeaver AS ABAP

• Standalone Web Dispatchers

• Embedded Web Dispatchers, including SAP HANA Extended Application Services (XS) Classic and XS Advanced

Onapsis demonstrated operating system command execution as <sid>adm, the account that owns the SAP installation.

CVE-2026-89103 (PROXYGATE)

CVE-2026-89103 affects SAP Gateway, which manages communications between SAP systems and external programs. Under specific access control list (ACL) configurations, a remote, unauthenticated threat actor with network access to the gateway service can be treated as a trusted SAP system and perform unauthorized actions.

Onapsis reported that successful exploitation can lead to operating system-level control of the SAP host as <sid>adm.

CVE-2026-120017 (SAML2 Authentication Bypass)

CVE-2026-120017 affects the Security Assertion Markup Language 2.0 (SAML2) authentication service in SAP NetWeaver AS ABAP.

Under certain configurations, the service can accept forged authentication assertions and create a valid SAP session without properly verifying the user’s identity. A remote, unauthenticated threat actor can authenticate as any SAP user, including privileged accounts. The vulnerability affects environments that use SAML2-based single sign-on for applications such as Fiori Launchpad and SAP GUI for HTML.

Additional vulnerabilities

The November Security Patch Day release also addressed several additional critical vulnerabilities affecting SAP products. These include:

• Code injection vulnerabilities in NetWeaver Knowledge Management XML Forms

• Operating system command injection in AS ABAP

• Missing authorization checks in S4CRM

• Cross-site request forgery vulnerabilities in Web Dispatcher and ICM

• XML external entity injection in SAP BusinessObjects Business Intelligence Platform

Successful exploitation can lead to code execution, operating system command execution, unauthorized business actions, or actions in an authenticated user’s context.

As of November 11, 2026, no exploitation or scanning activity targeting these vulnerabilities has been publicly reported, and none have been added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog.

Analysis

The most exposed systems are internet-facing SAP Web Dispatchers and ICM services running affected SAP Kernel versions. Onapsis identified kernel versions 7.40 through 7.89 as affected, including versions that have reached end of maintenance and require upgrades before security fixes can be applied.

Internet exposure increases risk, but it is not required for exploitation. Internal-only SAP systems remain susceptible if a threat actor gains access through a compromised workstation, trusted partner connection, virtual private network (VPN) session, or another application on the same network. SAP Gateway services reachable from user networks further increase exposure to PROXYGATE.

SAP environments process payroll, financial transactions, supply chain operations, and other business-critical functions, making them attractive targets for both financially motivated and state-aligned threat actors.

Since November 2021, CISA has added 14 SAP vulnerabilities to its KEV catalog, including several used by ransomware operators. In August 2026, a vulnerability in SAP Commerce Cloud was exploited within days of patch release, demonstrating how quickly SAP vulnerabilities can be weaponized once technical details become public.

The highest-risk scenario combines operating system-level access with privileged access inside SAP. Depending on the affected environment, a threat actor could:

• Modify payment information

• Extract human resources and financial records

• Access stored database credentials

• Move laterally through trusted RFC connections to other SAP systems

Successful exploitation of the SAML2 vulnerability against an emergency or firefighter account could also allow creation of persistent privileged accounts that remain after patching.

How far compromise extends beyond the affected SAP system depends on network segmentation, RFC trust relationships, user privileges, and the role of the compromised host within the SAP landscape.

Mitigations

Upgrade the SAP Kernel and every Web Dispatcher to the levels in SAP Notes 3778530, 3778556, and 3798345, and apply SAP Note 3849308 to affected SAP_BASIS releases to correct the memory corruption, gateway access control, and SAML2 signature validation flaws.

For HANA XS Classic, upgrade to SPS08 revision 089.05 or SPS07 revision 079.11; for XS Advanced, upgrade to version 1.5.4 or later.

Identify every standalone and embedded Web Dispatcher, ICM endpoint, SAP Gateway, and SAML2-enabled AS ABAP system to establish the remediation scope. Common indicators include sapwebdisp and icman processes, SAP HANA XS instances, listening ports in the 33xx and 48xx ranges, and trusted IdPs configured in transaction SAML2.

Review the running kernel version on each instance after restart to confirm the patched binary is loaded, because a support package installed without a restart leaves the vulnerable kernel in memory.

Restrict ICM access to traffic routed through a patched Web Dispatcher, or disable WebSocket support until patching is complete, to remove the ICM2SHELL path. Disabling WebSocket affects ABAP Push Channels and some Fiori applications.

Limit gateway ports to SAP server networks, and after patching set gw/acl_mode_proxy on kernels up to 7.77, confirm gw/acl_mode is 1, and add explicit rules to secinfo and reginfo to remove the conditions PROXYGATE depends on.

Review trusted IdPs in transaction SAML2 to confirm that only expected providers can issue assertions accepted by AS ABAP.

Monitor for processes spawned by icman, sapwebdisp, or gwrd, unexpected crashes and core dumps in instance work directories, inbound gateway connections from outside SAP server networks, privileged SAML logons with no matching IdP authentication event, and user creation or authorization changes since November 10, 2026.

Rotate passwords for privileged and technical accounts, RFC destination credentials, and database credentials where compromise is identified to remove access obtained before the update.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up