SAP’s November 10 security updates address four vulnerabilities rated CVSS 10.0. They include ICM memory corruption, CVE-2026-76964; Web Dispatcher memory corruption, CVE-2026-89126; Gateway access-control failure, CVE-2026-89103; and a SAML2 authentication flaw, CVE-2026-120017.
Onapsis calls the first two ICM2SHELL. It says malformed WebSocket traffic can enable unauthenticated command execution as the SAP installation owner. Researchers supplied SAP with a working exploit, but reported no observed exploitation in the wild as of November 10. Demonstrated exploitation therefore should not be confused with confirmed attacks.
Remediation requires the fixes in SAP Notes 3778530 and 3778556, covering application servers and Web Dispatchers, including embedded HANA components. Onapsis warns that kernel 7.93 patch level 419 remains vulnerable; administrators should follow the note’s release-specific instructions rather than assume any numerically higher patch is safe.
The Gateway flaw, dubbed PROXYGATE, also needs configuration review. On many releases, the kernel fix must accompany gw/acl_mode_proxy=1; a permissive prxyinfo policy still leaves exposure. Prioritize externally reachable components and verify every application server, rather than stopping after the primary instance.
