NetWeaver

SAP Patches Four Maximum-Severity Flaws Including ICM2SHELL and PROXYGATE in November 2026 Updates

SAP has released its November 2026 security updates addressing 35 vulnerabilities across multiple products, with four rated at the highest severity level of 10/10 on the CVSS scale. The patches cover memory corruption and missing authentication issues in NetWeaver Application Server ABAP components, as well as broken access control in SAP Gateway and memory corruption in Web Dispatcher. Cybersecurity firm Onapsis, which discovered three of the flaws, tracks CVE-2026-76964 and CVE-2026-89126 collectively as ICM2SHELL and CVE-2026-89103 as PROXYGATE, both enabling unauthenticated remote code execution. These vulnerabilities allow attackers to compromise core SAP systems without credentials or user interaction, potentially exposing business data and transaction integrity. The update follows a series of other critical SAP fixes in recent months, including issues in Commerce Cloud, SAP Kernel, and BTP applications, some of which have seen active exploitation.