620/69 Wednesday, November 11, 2026
SAP has released its November 2026 security updates to address 35 vulnerabilities, including four maximum-severity Critical flaws with CVSS scores of 10.0 affecting SAP NetWeaver Application Server ABAP, SAP Web Dispatcher, and SAP Gateway. These products are key components of SAP environments used for application connectivity, authentication, user management, and business data processing. The four vulnerabilities are CVE-2026-76964, a Memory Corruption flaw in the Internet Communication Manager (ICM); CVE-2026-120017, a Missing Authentication vulnerability in the SAML2 Service Provider component of NetWeaver Application Server ABAP; CVE-2026-89103, a Broken Access Control vulnerability in SAP Gateway; and CVE-2026-89126, a Memory Corruption flaw in SAP Web Dispatcher. SAP rated all four vulnerabilities at the maximum severity level, with successful exploitation potentially allowing unauthenticated attackers to gain extensive control over affected systems.
Cybersecurity company Onapsis, which discovered and reported three of the vulnerabilities, collectively named CVE-2026-76964 and CVE-2026-89126 ICM2SHELL, while referring to CVE-2026-89103 as PROXYGATE. ICM2SHELL involves flaws in components responsible for processing web traffic and could allow an attacker to achieve Remote Code Execution (RCE) without requiring an SAP account, password, or user interaction. PROXYGATE could allow an external attacker to make SAP Gateway treat a connection as originating from a trusted internal application server, potentially bypassing authorization checks and executing commands with the privileges of the account used to install SAP, without authentication. Successful exploitation against production Enterprise Resource Planning (ERP) environments could affect the confidentiality of business information, the integrity of transactions, and the availability of critical enterprise applications.
SAP stated that all four Critical vulnerabilities have been addressed through its November 2026 security updates. Earlier in the year, the company also patched several other maximum-severity vulnerabilities, including CVE-2026-58231 in SAP Commerce Cloud in August, which was reportedly exploited in the wild; CVE-2026-44756, also known as OVERPASS, a Memory Corruption vulnerability in SAP Kernel patched in September; and CVE-2026-89111, a Server-Side Request Forgery (SSRF) vulnerability involving OAuth2 in SAP Business Technology Platform (BTP), patched in October. In addition, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 14 SAP vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog since November 2021, including three that have been associated with ransomware activity. Organizations using SAP products should promptly identify affected versions, apply the security patches provided by SAP, and review access permissions to reduce the risk of attackers compromising critical enterprise systems.