Enterprise software maker SAP on Tuesday announced the release of 42 new and updated security notes, including nine that resolve critical-severity vulnerabilities.
Four of SAP’s new security notes address maximum-severity flaws in NetWeaver (Internet Communication Manager (ICM) and SAML2 Service Provider), Web Dispatcher, and Gateway.
The ICM and Web Dispatcher flaws, tracked as CVE-2026-76964 and CVE-2026-89126, are a single weakness in the SAP kernel component that receives HTTP, HTTPS, and WebSocket traffic.
According to Onapsis, which calls the security defect ICM2SHELL, the issue is related to reassembling large WebSocket messages, which may be split into fragments during a server-browser exchange and then put together by the receiver.
“A specially crafted sequence of WebSocket messages makes the ICM or the WD write attacker-controlled data past the end of the memory it reserved for the connection. Depending on how that data is shaped, the result is either an immediate crash of the process or controlled corruption of its memory,” Onapsis explains.
ICM2SHELL, the enterprise application security firm says, could allow an attacker to execute operating system commands with <sid>adm privileges.
“This is not a theoretical outcome. The Onapsis Research Labs provided SAP a working exploit that achieves full, unauthenticated remote code execution end to end, running arbitrary commands as <sid>adm on the target system. The denial-of-service condition, in turn, reproduced on every SAP Kernel release tested,” Onapsis says.
The max-severity SAP Gateway flaw, tracked as CVE-2026-89103 and referred to as ProxyGate, could be exploited by unauthenticated attackers to achieve remote code execution (RCE) without user interaction.
It is related to the prxyinfo access-control list, which should restrict requests to trusted networks only. However, if left open, it allows an attacker to send a series of requests that appear to be originating from an internal network, tricking the gateway into accepting them.
This allows an attacker to execute OS commands with the <sid>adm privileges and gain full control over the SAP system, without providing a username, password, or certificate.
“Because the flaw is in the SAP kernel, it affects a broad range of releases, including kernel versions that are already out of maintenance. Further, the gateway runs not only on ABAP but also on AS Java, dual-stack, and standalone-gateway systems,” Onapsis explains.
SAP also resolved a max-severity missing authentication bug in NetWeaver (CVE-2026-120017) that, in certain configurations, could allow unauthenticated attackers to submit specially crafted data and impersonate arbitrary users, which could lead to full system compromise.
The remaining five critical notes in SAP’s November 2026 bulletin address vulnerabilities in NetWeaver (CVE-2026-109803 and CVE-2026-76965), S4CRM (CVE-2026-109795), Web Dispatcher (CVE-2026-89119), and BusinessObjects (CVE-2026-109798).
Additionally, SAP published 17 high-severity fixes, including for multiple memory corruption, denial-of-service (DoS), and information disclosure bugs.
Since the scheduled October 2026 security patches, SAP released new notes dealing with the recently disclosed PHP2Shell and Node2Shell vulnerabilities in its Business AI Platform and updated several other notes and advisories. This brings the total to 43 new and updated notes released this month, Onapsis notes in its analysis of the patches.
Related: Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes
Related: N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days
Related: IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
Related: Chrome Update Patches Exploited XML Zero-Day, Eighth This Year
