SAP Patches Critical ICM2SHELL and ProxyGate Vulnerabilities Enabling Unauthenticated RCE

SAP has released 42 new and updated security notes addressing nine critical-severity vulnerabilities across its enterprise software portfolio. The most severe issues affect NetWeaver, Web Dispatcher, and Gateway components, including the ICM2SHELL flaw that permits remote code execution as <sid>adm through specially crafted WebSocket message sequences. Onapsis provided SAP with a working exploit demonstrating full unauthenticated remote code execution and denial-of-service conditions across multiple kernel releases. Another maximum-severity issue, ProxyGate (CVE-2026-89103), allows attackers to bypass access-control lists and execute OS commands without credentials by spoofing internal network requests. Additional critical fixes address missing authentication in SAML2 and memory corruption bugs in S4CRM, BusinessObjects, and Web Dispatcher. SAP also updated notes related to previously disclosed PHP2Shell and Node2Shell issues in its Business AI Platform.

SecurityWeekNovember 10, 2026Translated from English

Read at source

SAP on Tuesday announced the release of 42 new and updated security notes, including nine that resolve critical-severity vulnerabilities. Four of SAP’s new security notes address maximum-severity flaws in NetWeaver (Internet Communication Manager (ICM) and SAML2 Service Provider), Web Dispatcher, and Gateway.

The ICM and Web Dispatcher flaws, tracked as CVE-2026-76964 and CVE-2026-89126, are a single weakness in the SAP kernel component that receives HTTP, HTTPS, and WebSocket traffic. According to Onapsis, which calls the security defect ICM2SHELL, the issue is related to reassembling large WebSocket messages, which may be split into fragments during a server-browser exchange and then put together by the receiver.

“A specially crafted sequence of WebSocket messages makes the ICM or the WD write attacker-controlled data past the end of the memory it reserved for the connection. Depending on how that data is shaped, the result is either an immediate crash of the process or controlled corruption of its memory,” Onapsis explains. ICM2SHELL could allow an attacker to execute operating system commands with adm privileges.

“This is not a theoretical outcome. The Onapsis Research Labs provided SAP a working exploit that achieves full, unauthenticated remote code execution end to end, running arbitrary commands as adm on the target system. The denial-of-service condition, in turn, reproduced on every SAP Kernel release tested,” Onapsis says.

The max-severity SAP Gateway flaw, tracked as CVE-2026-89103 and referred to as ProxyGate, could be exploited by unauthenticated attackers to achieve remote code execution (RCE) without user interaction. It is related to the prxyinfo access-control list, which should restrict requests to trusted networks only. However, if left open, it allows an attacker to send a series of requests that appear to be originating from an internal network, tricking the gateway into accepting them.

This allows an attacker to execute OS commands with the adm privileges and gain full control over the SAP system, without providing a username, password, or certificate. “Because the flaw is in the SAP kernel, it affects a broad range of releases, including kernel versions that are already out of maintenance. Further, the gateway runs not only on ABAP but also on AS Java, dual-stack, and standalone-gateway systems,” Onapsis explains.

SAP also resolved a max-severity missing authentication bug in NetWeaver (CVE-2026-120017) that, in certain configurations, could allow unauthenticated attackers to submit specially crafted data and impersonate arbitrary users, which could lead to full system compromise.

The remaining five critical notes in SAP’s November 2026 bulletin address vulnerabilities in NetWeaver (CVE-2026-109803 and CVE-2026-76965), S4CRM (CVE-2026-109795), Web Dispatcher (CVE-2026-89119), and BusinessObjects (CVE-2026-109798).

SAP Onapsis CVE-2026-76964 CVE-2026-89103 NetWeaver PROXYGATE

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Vulns & Exploits

Threat Actors Exploit AhsayCBS Zero-Days CVE-2026-105133 and CVE-2026-105134 to Deploy Sandbox-Evading Python Backdoor

Cybersecurity researchers at Huntress have detailed an October 2026 intrusion that chained two patched vulnerabilities in AhsayCBS to bypass authentication and execute arbitrary commands. The attackers deployed multiple JSP web shells, two variants of the XMRig cryptocurrency miner, tunneling tools, and a custom Python backdoor designed to evade sandboxes by verifying the host's MachineGuid hash. Patches for CVE-2026-105133 and CVE-2026-105134 were issued by Ahsay Backup in mid-October 2026 after the flaws were exploited as zero-days. The operation showed notable persistence on backup servers, including Microsoft Defender exclusions, scheduled tasks, and legitimate remote access software. Huntress also observed related activity on a Veeam server involving credential theft from the PostgreSQL database using NetExec and DPAPI decryption. The campaign targeted backup infrastructure specifically rather than conducting opportunistic smash-and-grab operations.

The Hacker NewsNov 10, 2026Translated from English

Vulns & Exploits

Binance Warns of iOS Sandbox Escape Flaw Exposing Crypto Wallet Secrets Across Multiple Versions

Binance has issued a security advisory highlighting a vulnerability in Apple’s iOS 26.7.1, 27.0.1, and 27.2 that enables malicious third-party apps to read private files from other applications. The flaw, referred to as worse_query, functions as a publicly disclosed sandbox escape technique that bypasses iOS security boundaries without requiring a jailbreak. A proof-of-concept tool named WQ Files has been released that can browse, export, edit, and delete data stored by other apps, directly threatening cryptocurrency seed phrases, private keys, and login credentials. No confirmed crypto losses have been reported yet, but Binance recommends immediate installation of the latest iOS updates, removal of untrusted apps, and wallet migration if compromise is suspected. Apple released patches on November 9 addressing nine issues, including CVE-2026-113963, which was reported by researcher László Várady and involves access via App Intents rather than App Group containers. It remains unclear whether CVE-2026-113963 matches the worse_query issue exactly.

BleepingComputerNov 10, 2026Translated from English

Vulns & Exploits

Binance Warns of Unpatched iOS Sandbox Escape worse_query Exposing Crypto Wallet Keys on iOS 26 and 27

Binance has issued a security advisory about an iOS sandbox escape vulnerability called worse_query that enables malicious apps to read files from other applications, including crypto wallets containing seed phrases, private keys, and credentials. The proof-of-concept exploit, published by researcher forcequit on GitHub, works on iPhones running iOS 26 and iOS 27 without requiring a jailbreak or kernel exploit. Apple's recent updates for iOS 26.7.3 and iOS 27.2.1, released yesterday, do not address the issue according to the official security notes. Apps built on the exploit, such as the WQ Files file manager by developer Christoph Kolbicz, can be installed via sideloading tools like AltStore and SideStore that automatically configure the required App Group container. Binance advises users to remove any sideloaded or untrusted apps, update all software, and move funds to a new wallet on a clean device if a breach is suspected. Neither Apple nor the researcher has confirmed any in-the-wild attacks or thefts involving the vulnerability.

The Hacker NewsNov 10, 2026Translated from English