SAP November 2026 Update Patches Four CVSS 10 Security Flaws

SAP released 35 security notes on November 10, 2026, to address critical vulnerabilities across its enterprise software suite. The update cycle is led by four separate flaws assigned a maximum CVSS severity score of 10.0, including the memory corruption issues dubbed “ICM2SHELL” and a gateway impersonation flaw known as “PROXYGATE.”

The most critical vulnerabilities affect the SAP Kernel, NetWeaver, and Web Dispatcher components. Because these flaws are “pre-authentication,” they can be exploited by remote attackers without a valid user account or internal credentials, potentially allowing for full system takeover or sensitive data extraction.

ICM2SHELL: Remote Code Execution

ICM2SHELL is an umbrella term for two memory corruption vulnerabilities: CVE-2026-76964, which affects the NetWeaver Internet Communication Manager (ICM), and CVE-2026-89126, which impacts the SAP Web Dispatcher. Onapsis Research Labs, which discovered three of the four maximum-severity flaws, demonstrated that a working end-to-end exploit can be built for these vulnerabilities.

The technical root of ICM2SHELL lies in how the SAP Kernel handles the reassembly of WebSocket control frames. An attacker can send specially crafted packets to trigger a buffer overflow, resulting in unauthenticated remote code execution (RCE). Organizations that cannot immediately apply the kernel patches are advised to implement network-level restrictions to block access to the ICM and Web Dispatcher from untrusted networks.

PROXYGATE and the Manual Remediation Requirement

The vulnerability identified as PROXYGATE (CVE-2026-89103) is a broken access control flaw within the SAP Gateway. This component facilitates communication between SAP systems and external applications. If exploited, an attacker could impersonate internal application servers, bypassing security filters to interact with the core SAP landscape.

Security researchers at Onapsis note that simply applying the binary kernel patch is insufficient to fully mitigate PROXYGATE. Administrators must manually update the gw/acl_mode_proxy profile parameter or tighten proxy access lists (prxyinfo) to prevent external server impersonation. Failure to perform this manual configuration change leaves the system vulnerable even after the software update is installed.

SAML 2.0 and Authentication Bypass

The fourth 10.0-severity vulnerability, CVE-2026-120017, affects the SAML 2.0 service provider used for single sign-on (SSO) in NetWeaver AS ABAP. This is a missing authentication flaw that could allow an attacker to bypass the SSO process entirely. In enterprise environments where SAML is the primary gateway for user access, this flaw represents a significant risk to the integrity of session management and user data.

The following table summarizes the four critical notes released during the November 2026 cycle:

SAP recommends that administrators prioritize these four notes immediately due to their high CVSS scores and the availability of exploit technicals. Beyond the critical kernel updates, the November release also includes 31 other notes addressing lower-severity cross-site scripting (XSS), information disclosure, and denial-of-service vulnerabilities across various ABAP and Java platform components.