SAP ICM2SHELL and PROXYGATE: Three CVSS 10.0 No-Login Flaws in the SAP Kernel and Gateway, a Fourth in SAML2, and the Patch Levels to Check

SAP released fixes on Tuesday, November 10, 2026 for three flaws that let an attacker with network access, and no username or password, take over an SAP system. The researchers at Onapsis who found them call them ICM2SHELL and PROXYGATE. If your company runs SAP ERP or S/4HANA, these flaws sit in the parts of SAP most likely to face the internet, so this patch should go ahead of routine maintenance.

What happened with SAP ICM2SHELL and PROXYGATE

SAP's Security Patch Day page for November 2026 lists 35 new security notes, plus 3 updates to older notes. Onapsis Research Labs found and reported the three flaws covered here. SAP rates all three Critical with the maximum CVSS score of 10.0.

A fourth note was also rated 10.0 that day. Onapsis does not describe it as one of its own findings. If you are checking your patch status, it belongs on the same list.

What is confirmed and what is not

Confirmed by Onapsis for ICM2SHELL: the flaw is memory corruption in the way the SAP kernel handles WebSocket traffic. The vulnerable code is shared by the Internet Communication Manager (ICM), which is SAP's built-in web server, and by the SAP Web Dispatcher, which routes web traffic to SAP. Onapsis says it gave SAP a working exploit. That exploit runs operating system commands as the <sid>adm user, the account that runs the SAP system, and needs no credentials, no user interaction and no special misconfiguration. Onapsis also says the same flaw reliably crashes the ICM or Web Dispatcher with a single connection on every release it tested.

Confirmed for PROXYGATE: Onapsis's Patch Day summary calls it a pre-authentication remote code execution flaw in SAP Gateway. The cause is a high-privilege default access control list in SAP Gateway that treats an outside attacker as one of the company's own SAP application servers. Onapsis adds that applying the note alone is not enough: customers must also set a profile parameter by hand. That summary does not name the parameter, so read SAP Note 3798345 with whoever runs your SAP Basis work. We could not find a separate full Onapsis write-up for PROXYGATE when this was written.

Confirmed for the SAML2 flaw: Onapsis says that under certain configurations, SAP does not check incoming login assertions closely enough. That lets attackers impersonate any user, including privileged accounts.

Not known: Onapsis says it has not seen ICM2SHELL exploited in the wild as of publication. The PROXYGATE summary does not say either way. Onapsis points out that an earlier group of ICM flaws, ICMAD in 2022, was later added to CISA's Known Exploited Vulnerabilities catalog after attacks began.

Which SAP systems are affected

For ICM2SHELL, Onapsis says exposure depends on the SAP kernel, not on your application release:

• Any SAP NetWeaver AS ABAP system on kernel 7.40 or higher.
• Any SAP Web Dispatcher, including the one embedded in SAP HANA XS.
• Dual-stack systems. AS Java on its own is not affected.
• Kernel 7.22 is not affected by ICM2SHELL.
• Unsupported kernels 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 are affected and may never get a fix. They have to be upgraded.

WebSocket support is on by default, so a system is exposed even if none of your applications use WebSockets. Onapsis also says some default S/4HANA web services accept WebSocket connections without a login.

PROXYGATE has a different range. SAP's page lists kernel 7.22 through 9.21, so a 7.22 system that is safe from ICM2SHELL still needs the PROXYGATE note. The SAML2 flaw covers SAP_BASIS 702 through 922.

SAP kernel patch levels that fix ICM2SHELL

From the Onapsis advisory:

One trap: on 7.93, a higher number does not always mean fixed. Onapsis says patch level 419 is still vulnerable. Check the exact level against SAP Note 3778530, not just whether you are past 401.

What to do this week

• List every SAP system by kernel release and patch level. Include standalone and embedded Web Dispatchers, test and development systems, and anything on an unsupported kernel.
• Patch internet-facing ICMs and Web Dispatchers first.
• Apply SAP Note 3798345 for PROXYGATE, then set the profile parameter it requires. The note on its own does not close the hole.
• Apply SAP Note 3849308 if you use SAML2 single sign-on.
• If you cannot patch right away, read FAQ Note 3778788. The temporary workaround is icm/HTTP/support_websocket_upgrade=FALSE followed by a restart. First check your HTTP logs for status code 101 requests, because turning WebSocket off breaks anything that uses it.
• Another option: a Web Dispatcher on 7.53 PL 1629, 7.54 PL 723, 7.93 PL 430, 9.16 PL 200 or higher can shield backends reached only through it. That does not work if icm/server_port_<x> is set to PROT=ROUTER.
• Limit HTTP and HTTPS access to SAP to the networks and users that need it.
• Watch dev_icm and dev_webdisp for unexpected restarts, and look out for the icman or Web Dispatcher process ID changing when nobody planned it.
• If you are on SAP's RISE private cloud, Onapsis points to Private Cloud Operations FAQ Note 3849055. Confirm with SAP who is applying the fix.

Why this matters for a company network

SAP usually runs a company's finance, orders, inventory and payroll. Control of <sid>adm means control of that system. Onapsis says an attacker could also recover database credentials and other secrets stored on it, and collect the technical credentials SAP uses to connect to other systems. One break-in can then spread to connected SAP and non-SAP systems.

The patch is also not a single click. PROXYGATE needs a manual setting after the note. On 7.93, a newer patch level can still be vulnerable. Old kernels need an upgrade, not a patch. This is the gap we wrote about in Updated Is Not the Same as Patched. Ask the question in Who Is Patching the Software That Runs Your Business? about your SAP partner by name, and get the answer in writing.

SAP ICM2SHELL questions people are asking

Is ICM2SHELL being exploited?

Not that anyone has confirmed. Onapsis says it had not seen exploitation in the wild when it published on November 10, 2026.

Does an attacker need a login for PROXYGATE or ICM2SHELL?

No. Both need only network access to the affected SAP component.

Which SAP kernel fixes ICM2SHELL?

It depends on the release. Examples: 7.53 PL 1616, 7.54 PL 710, 9.16 PL 111, 9.20 PL 11. See the table above, and check 7.93 carefully.

Can I turn off WebSocket instead of patching?

Only as a stopgap. SAP warns that turning it off has a significant effect on interactive and integration scenarios, so check your logs first.

Does installing the PROXYGATE note fix it?

Not by itself. Onapsis says you also have to set a profile parameter by hand.

Is SAP HANA affected?

The Web Dispatcher embedded in SAP HANA XS is affected by ICM2SHELL. Onapsis says SAP Content Server is not.

The bigger lesson

The most dangerous flaws are often in the parts of a system nobody thinks about, such as the kernel, the web layer and the defaults. Fixing them means knowing exactly which version runs on every server and who is responsible for each one.

For help hardening the systems that run your business, see security hardening or request a quote.

Get security alerts like this by email, with the free checklist, at /security-alerts.

Sources: SAP Security Patch Day, November 2026; Onapsis ICM2SHELL threat advisory; Onapsis SAP Security Patch Day for November 2026.