SAP Patches ICM2SHELL, PROXYGATE: Four CVSS 10 Flaws

SAP fixed four maximum-severity vulnerabilities on 10 November 2026. All four are rated CVSS 10.0 in SAP's November 2026 Security Patch Day listing, and all four can be reached without a SAP user, password or user interaction. Onapsis, the SAP security firm that found and reported three of them, names two of them ICM2SHELL and PROXYGATE and says it has not observed them exploited in the wild.

Who this is for: CISOs, SAP basis and security teams, and anyone who runs ERP in the data centre or the cloud.

Based on SAP's patch-day page and three Onapsis advisories, read on 11 November 2026, plus BleepingComputer's report of 10 November (we could not open its page, so we cite it only where noted). PlayCISO is not affiliated with SAP or Onapsis. We publish no exploit details.

The four CVSS 10.0 flaws

What Onapsis adds. ICM2SHELL is memory corruption in how the SAP kernel handles WebSocket traffic, and "WebSocket support is enabled by default, whether or not it is used". PROXYGATE is described as a pre-authentication remote code execution flaw in SAP Gateway; Onapsis says it works "by convincing the SAP Gateway that an unauthenticated, external attacker is one of the internal application servers", ending in control of the system as the account that owns the installation. SAP's own listing is the narrower "broken access control"; both are the same CVE.

Affected systems and patch order

• Kernel: SAP lists KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20 for the ICM flaw and kernels 7.22 to 9.21 for PROXYGATE; Web Dispatcher releases are listed under CVE-2026-89126. Onapsis says "if your kernel is below the fixed patch level, your system is vulnerable", and that kernels out of maintenance are also affected and "may not receive a fix".
• AS Java: Onapsis says AS Java alone is not affected, but dual-stack installations are because of their ABAP stack.
• SAML2: CVE-2026-120017 lists SAP_BASIS 702 to 758, 816 and 920 to 922.
• Order: internet-facing Web Dispatchers, ICM and Gateways first; then internal systems that accept connections from other networks; then everything else.

Workarounds, as Onapsis reports them

• ICM2SHELL: setting icm/HTTP/support_websocket_upgrade=FALSE and restarting removes the vulnerability, but "multiple features depend on WebSocket" and SAP warns of significant impact. A Web Dispatcher updated to a higher patch level can also protect the backends behind it.
• PROXYGATE: "Until a system can be patched, SAP lists no official workaround". On most kernels the fix is a kernel patch plus setting gw/acl_mode_proxy = 1.

The run of maximum-severity SAP flaws

This is not the first this autumn. Onapsis published a remediation guide for OVERPASS (CVE-2026-44756) in September 2026: a CVSS 10.0 memory-corruption flaw in how the SAP kernel processes the Extended Passport, fixed in Note 3747649. It says it had not observed in-the-wild exploitation at publication, and that SAP authorisations and segregation-of-duties controls would not help. BleepingComputer also reports a maximum-severity flaw in SAP Commerce Cloud (CVE-2026-58231) patched in August that threat-intelligence firm Defused flagged as exploited days later, a maximum-severity OAuth2 server-side request forgery in multi-tenant BTP applications (CVE-2026-89111), and that CISA lists 14 SAP flaws as exploited since November 2021, three of them used by ransomware groups. We could not find the Commerce Cloud or BTP CVEs on SAP's or Onapsis's pages and did not complete a KEV check, so treat those as BleepingComputer's reporting, not our confirmation.

Timeline

What security leaders should do this week

• Inventory SAP kernels. List every ABAP and dual-stack system, its kernel release and patch level, and its Web Dispatcher. Out-of-maintenance kernels are affected and may get no fix: plan an upgrade, not a patch.
• Find what faces the network. Web Dispatcher and ICM are network-facing by design. Confirm which are reachable from the internet or from partner networks, and put those first.
• Apply notes 3778530, 3778556, 3798345 and 3849308, and for PROXYGATE also review the Gateway profile parameter Onapsis names.
• If you cannot patch, decide with the business whether to disable WebSocket support for ICM2SHELL; Onapsis and SAP both warn it breaks features. Record the exception with an owner and a date.
• Hunt and log. Onapsis has observed no exploitation, but plan for the day that changes: make sure ICM, Web Dispatcher and Gateway logs reach your SIEM.
• Prioritise with data. Check KEV and EPSS in the KEV checker and EPSS lookup, then set the deadline with the SSVC calculator.
• Ask your SAP hosting partner whether RISE or managed systems are already patched, and get the date in writing.

Frequently asked questions

What are ICM2SHELL and PROXYGATE?

Names Onapsis gave to SAP flaws it found and reported. ICM2SHELL covers CVE-2026-76964 (SAP NetWeaver AS ABAP Internet Communication Manager) and CVE-2026-89126 (SAP Web Dispatcher), both memory corruption in how the SAP kernel handles WebSocket traffic. PROXYGATE is CVE-2026-89103 in SAP Gateway, which SAP titles "Broken Access Control" and Onapsis describes as pre-authentication remote code execution. All three are rated CVSS 10.0, and none needs a SAP user or password.

What is the fourth maximum-severity flaw?

CVE-2026-120017, "Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform" in the SAML2 Service Provider component (SAP Security Note 3849308, CVSS 10.0, SAP_BASIS 702 to 758, 816 and 920 to 922). Onapsis did not publish an advisory for it that we could read, so we have SAP's listing only.

Are ICM2SHELL and PROXYGATE being exploited?

Onapsis says its Research Labs "have not observed active in-the-wild exploitation" of either as of its 10 November 2026 advisories. It says it gave SAP a working exploit for each and withholds technical details. That can change quickly, so treat it as a snapshot and re-check CISA KEV.

Is there a workaround if I cannot patch this week?

For ICM2SHELL, Onapsis says setting icm/HTTP/support_websocket_upgrade=FALSE and restarting removes the vulnerability, but SAP warns disabling WebSocket has a significant impact because multiple features depend on it. Onapsis also says a Web Dispatcher on a higher patch level can shield the backends behind it. For PROXYGATE, Onapsis says SAP lists no official workaround until a system can be patched, and the fix on most kernels combines a kernel patch with setting gw/acl_mode_proxy = 1.

Which SAP systems are affected?

The kernel is at the centre: SAP lists KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20 for the ICM flaw, Web Dispatcher and kernel versions for the second ICM2SHELL CVE, and kernels 7.22 to 9.21 for PROXYGATE. Onapsis says AS Java alone is not affected but dual-stack systems are because of their ABAP stack, and that kernels out of maintenance are also affected and may not get a fix. Check the minimum patch level in each SAP Note for your kernel.

Which SAP notes should I apply?

SAP Security Notes 3778530 (CVE-2026-76964, ICM), 3778556 (CVE-2026-89126, Web Dispatcher), 3798345 (CVE-2026-89103, Gateway) and 3849308 (CVE-2026-120017, SAML2 Service Provider). Onapsis also points to FAQ notes 3778788 (ICM2SHELL) and 3810197 (PROXYGATE).

How many flaws did SAP fix in November 2026?

SAP's page says 35 new security notes, 3 updates to earlier notes and 4 GitHub security advisories. Onapsis counts 43 new and updated patches, including 12 HotNews notes and 13 high-priority notes. BleepingComputer says 35 vulnerabilities. A note can cover more than one CVE, so the numbers are not directly comparable.

Sources

• SAP: Security Patch Day, November 2026 (10 November 2026)
• Onapsis: ICM2SHELL threat advisory, CVE-2026-76964 and CVE-2026-89126 (10 November 2026)
• Onapsis: PROXYGATE threat advisory, CVE-2026-89103 (10 November 2026)
• Onapsis: SAP Security Patch Day, November 2026 summary (10 November 2026)
• Onapsis: Mitigating OVERPASS, CVE-2026-44756 (8 September 2026, updated 21 September 2026)
• BleepingComputer, "SAP patches ICM2SHELL and PROXYGATE maximum severity flaws", Sergiu Gatlan, 10 November 2026 (not opened by us; cited for the Commerce Cloud, BTP and CISA statements only)