SAP vulnerabilities in 2026: ICM2SHELL, PROXYGATE and OVERPASS (not a breach of SAP)
SAP sells the ERP software many large companies run their finance and supply chain on, so its security patches matter well beyond SAP itself. This page tracks the maximum-severity vulnerabilities in SAP products in autumn 2026. It separates SAP's own listing from what Onapsis, the firm that found several of them, says about exploitation.
Short answer
Was SAP hacked?
No breach of SAP's own systems is reported in the sources we read. What is reported are vulnerabilities in SAP products. On 10 November 2026 SAP's Security Patch Day listed four flaws at CVSS 10.0 that can be reached without a SAP user or password: memory corruption in the NetWeaver ABAP Internet Communication Manager (CVE-2026-76964) and in SAP Web Dispatcher (CVE-2026-89126), broken access control in SAP Gateway (CVE-2026-89103) and missing authentication in the SAML2 Service Provider (CVE-2026-120017).
Onapsis, which found and reported ICM2SHELL (the first two) and PROXYGATE (the Gateway flaw), says it has not observed active exploitation in the wild. In September 2026 Onapsis published a remediation guide for OVERPASS (CVE-2026-44756), another CVSS 10.0 SAP kernel flaw.
Timeline at a glance
8 Sep 2026Onapsis publishes its OVERPASS remediation guide (CVE-2026-44756, SAP Kernel, CVSS 10.0, SAP Note 3747649). (Onapsis)Not a breach
10 Nov 2026SAP Security Patch Day: 35 new notes, 3 updates and 4 GitHub advisories; four notes at CVSS 10.0. (SAP)Confirmed
10 Nov 2026Onapsis publishes the ICM2SHELL and PROXYGATE advisories; says it has not observed in-the-wild exploitation. (Onapsis)Reported
Last updated 11 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
SAP incident timeline, in detail
Confirmed = acknowledged by SAP, a regulator filing or a court. Reported = credible reporting SAP has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Nov 2026Not a breachProduct vulnerabilities (pre-authentication)
Four CVSS 10.0 flaws patched: ICM2SHELL, PROXYGATE and a SAML2 authentication gap
What happened. SAP's November 2026 listing gives CVSS 10.0 to notes 3778530 (CVE-2026-76964, memory corruption in NetWeaver AS ABAP ICM), 3778556 (CVE-2026-89126, memory corruption in SAP Web Dispatcher), 3798345 (CVE-2026-89103, broken access control in SAP Gateway) and 3849308 (CVE-2026-120017, missing authentication in the SAML2 Service Provider). Onapsis names the first two ICM2SHELL and the third PROXYGATE, and says it gave SAP a working exploit for each.
Impact. Onapsis says ICM2SHELL gives unauthenticated remote code execution against the network-facing component, and that PROXYGATE leads to control of the system as the account that owns the installation. It says it has not observed in-the-wild exploitation. For ICM2SHELL it names a WebSocket workaround with significant impact; for PROXYGATE it says SAP lists no official workaround until a system can be patched.
OVERPASS: a CVSS 10.0 memory-corruption flaw in the SAP kernel
What happened. Onapsis says it identified and responsibly disclosed a critical flaw in how the SAP kernel processes the Extended Passport, fixed by SAP Note 3747649 at the September patch day (CVE-2026-44756, CVSS 10.0).
Impact. Onapsis says it had not observed in-the-wild exploitation at publication, and that SAP authorisations and segregation-of-duties controls will not stop it.
Counts: SAP lists 35 new security notes, 3 updates and 4 GitHub advisories; Onapsis counts 43 new and updated patches, including 12 HotNews notes. A note can cover more than one CVE.
Naming: ICM2SHELL and PROXYGATE are Onapsis's names; SAP's page uses only the CVE titles. SAP titles CVE-2026-89103 "Broken Access Control"; Onapsis calls it pre-authentication remote code execution. Same CVE.
Scope: SAP's version list for the ICM flaw covers kernels 7.53 to 9.20; Onapsis says unsupported kernels 7.40 to 7.89 are also affected and may not receive a fix.
BleepingComputer (10 Nov 2026) also reports a Commerce Cloud flaw (CVE-2026-58231) that Defused flagged as exploited, a BTP OAuth2 flaw (CVE-2026-89111) and 14 SAP entries in CISA KEV. We could not find these on SAP's or Onapsis's pages or confirm them, so they are not listed above.
The pattern across the record
A run of maximum-severity SAP kernel flaws
OVERPASS in September and ICM2SHELL and PROXYGATE in November are all flaws in the shared SAP kernel and its network-facing components. That makes kernel patch level, not application configuration, the control that decides exposure.
Vulnerabilities are not breaches
None of these pages reports an intrusion at SAP. The risk is to customers who run the software, and it depends on how quickly each customer patches.
What it means for SAP customers — and what to do
If you run SAP, the question is your kernel patch level and which systems face the network, not whether SAP was breached.
1.Patch the four notes
Apply SAP Notes 3778530, 3778556, 3798345 and 3849308. Start with Web Dispatchers, ICM and Gateways reachable from the internet or partner networks.
2.Check kernel support status
Onapsis says kernels out of maintenance are affected and may not get a fix. Plan an upgrade for those systems.
3.Decide the deadline with data
Check KEV and EPSS, then set a patch deadline you can defend.
No breach of SAP's own systems is reported in the sources we read. The 2026 stories are about vulnerabilities in SAP products.
What are ICM2SHELL and PROXYGATE?+
Onapsis's names for SAP flaws it found: ICM2SHELL covers CVE-2026-76964 and CVE-2026-89126 (memory corruption in ICM and Web Dispatcher), PROXYGATE is CVE-2026-89103 in SAP Gateway. All are CVSS 10.0 and need no SAP login.
Are they being exploited?+
Onapsis said on 10 November 2026 that it has not observed in-the-wild exploitation of either. Re-check CISA KEV, as that can change quickly.
Which SAP Notes fix them?+
Notes 3778530, 3778556, 3798345 and, for the SAML2 flaw, 3849308.
Is there a workaround?+
For ICM2SHELL Onapsis names disabling WebSocket support, which SAP warns has significant impact. For PROXYGATE Onapsis says SAP lists no official workaround until a system is patched.
Independent analysis for security-leadership education; not affiliated with or endorsed by SAP. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.