SAP ICM2SHELL and PROXYGATE: Four 10.0 Flaws in NetWeaver, Web Dispatcher and Gateway, the Fixed Kernel Patch Levels and What to Check This Week

SAP released fixes on November 10, 2026 for four flaws rated 10.0 out of 10. Three of them are in the SAP kernel components that handle web traffic and connections between systems. If your company runs SAP NetWeaver, S/4HANA, SAP Web Dispatcher or SAP HANA, the researchers say an attacker who can reach those services could run commands on the server without a password, so kernel patching belongs on this week's schedule.

What SAP fixed on November 2026 Patch Day

SAP published its November 2026 Security Patch Day on Tuesday, November 10, 2026: 35 new security notes, 4 GitHub security advisories and 3 updates to earlier notes. Nine notes are rated Critical, and four have the maximum CVSS score of 10.0:

Onapsis Research Labs reported the ICM2SHELL and PROXYGATE flaws to SAP and gave them those names.

What is confirmed and what is not known

• Confirmed by SAP: the four notes, their 10.0 scores and the affected product versions, all on its public patch day page.
• Confirmed by the researchers: Onapsis says it gave SAP a working ICM2SHELL exploit that runs commands as the SAP system account (<sid>adm) with no SAP user, no password and no user interaction. It describes PROXYGATE as remote code execution before login, also as <sid>adm.
• Not known: Onapsis says that as of November 10 it had not seen either flaw used in real attacks, and it is holding back technical details for now. We found no statement from SAP or anyone else about attacks on the SAML2 flaw.

Which SAP systems are affected by ICM2SHELL

The ICM is the part of the SAP kernel that answers HTTP and HTTPS requests, and the Web Dispatcher is SAP's front door for web traffic. Onapsis says these are the SAP parts most likely to face the internet. According to its advisory, what decides exposure is the kernel, not the application release:

• SAP NetWeaver AS ABAP on kernel 7.40 or higher, including dual-stack systems. AS Java on its own is not affected, and neither is kernel 7.22.
• Every SAP Web Dispatcher, standalone or embedded in SAP HANA XS.
• The attack goes through WebSocket support, which is on by default whether or not you use it.

Fixed patch levels listed by Onapsis:

A higher number does not always mean fixed: on 7.93, patch level 419 is newer than 401 and still affected. Kernels 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 are affected and may get no fix, so they need to move to a supported, downward-compatible kernel.

If you cannot patch right away, SAP's FAQ note 3778788 covers two stopgaps, as Onapsis summarizes them. A patched Web Dispatcher in front (7.53 PL 1629, 7.54 PL 723, 7.93 PL 430, 9.16 PL 200 or higher) can shield systems that are reachable only through it, unless it uses PROT=ROUTER. Or you can set icm/HTTP/support_websocket_upgrade=FALSE and restart. Check the HTTP log for status 101 requests first: SAP warns this setting can break interactive and integration scenarios.

Which SAP systems are affected by PROXYGATE

SAP Gateway carries RFC connections between SAP systems and other programs. Onapsis says PROXYGATE tricks the gateway into treating an outside attacker as an internal application server. The flaw is in the kernel, so ABAP, AS Java, dual-stack and standalone gateways are all in scope.

Three points from the Onapsis advisory matter most:

• Hardening secinfo and reginfo does not stop PROXYGATE. What matters is the proxy access list, prxyinfo.
• The kernel patch alone is not enough. You also need a restrictive prxyinfo file or gw/acl_mode_proxy = 1. That parameter ships set to 0, which allows everything. Kernels 7.93 and 9.16 already support it and need no new kernel: set it to 1.
• Out-of-maintenance kernels 7.20, 7.21, 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 are affected and need an upgrade (FAQ note 3810197).

SAP SAML2 vulnerability CVE-2026-120017

The fourth 10.0 is a missing-authentication flaw in the SAML2 Service Provider of SAP NetWeaver AS ABAP and ABAP Platform, the piece that handles single sign-on. SAP's public patch day page lists 16 affected SAP_BASIS releases: 702, 731, 740, 750 to 758, 816, 920, 921 and 922. That page does not say how the flaw works, and we found no write-up from researchers. The technical detail and the fix are in note 3849308, which needs an SAP support login to read. We could not confirm whether systems that do not use SAML are exposed, so check the note instead of assuming you are safe.

SAP security patch checklist for this week

Why this matters for a business running SAP

SAP is usually where orders, invoices, payroll, stock and customer records live. An attacker running commands as <sid>adm controls the SAP system and the data in it. Kernel patches need a restart and testing, so book the maintenance window now instead of waiting for reports of attacks. The 7.93 case is another reminder that a newer build is not proof of a fix, which we covered in Updated Is Not the Same as Patched. If nobody in your company clearly owns SAP kernel updates, start with Who Is Patching the Software That Runs Your Business?

SAP ICM2SHELL and PROXYGATE questions people are asking

What is ICM2SHELL?

It is the name Onapsis gave to CVE-2026-76964 (ICM) and CVE-2026-89126 (Web Dispatcher). Both are memory corruption flaws rated 10.0, and Onapsis says they allow remote code execution with no login.

What is PROXYGATE?

It is the name Onapsis gave to CVE-2026-89103, a broken access control flaw in SAP Gateway rated 10.0. Onapsis says it lets an attacker run commands before logging in.

Is ICM2SHELL or PROXYGATE being exploited?

Not as of November 10, 2026, according to Onapsis, which says it will update its advisories if that changes.

Is SAP Web Dispatcher affected?

Yes. Onapsis says every Web Dispatcher is affected by ICM2SHELL, including the one built into SAP HANA XS.

Does the PROXYGATE patch alone fix it?

No. Onapsis says you also need a restrictive prxyinfo file or gw/acl_mode_proxy set to 1.

Is SAP S/4HANA affected?

Onapsis says default S/4HANA services accept WebSocket connections without authentication, so check the kernel release and patch level on every S/4HANA server.

The bigger lesson

This month's most serious SAP flaws are not in an SAP application. They are in the kernel underneath, which many teams patch least often. Know which kernel every SAP server runs, including test systems and the old machine nobody touches, and keep it current.

For help hardening the systems that hold your business data, see security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: SAP Security Notes November 2026; Onapsis ICM2SHELL advisory; Onapsis PROXYGATE advisory.