SAP NetWeaver Vulnerabilities: Four CVSS 10.0 Flaws in ICM, Web Dispatcher, Gateway and SAML2, No Login Needed, and What to Patch This Week

SAP released its November 2026 security patches on Tuesday, November 10, 2026. Four of them fix flaws rated 10.0, the highest CVSS score, and an attacker can use any of the four over the network without logging in. Three can let an outsider run commands on an SAP server, and the fourth affects SAML single sign-on logins. If your business runs SAP NetWeaver, SAP Web Dispatcher or SAP HANA XS, these four notes come first in this month's patching.

What SAP fixed in the November 2026 patch day

SAP's November bulletin lists 35 new security notes. These four carry the 10.0 score:

Onapsis Research Labs found the first three and reported them to SAP. It calls the shared ICM and Web Dispatcher bug ICM2SHELL and the Gateway bug PROXYGATE. In both cases Onapsis says a successful attacker runs commands as the <sid>adm operating system account, which gives full control of the SAP system.

What is confirmed and what is not

Confirmed: SAP scores all four at 10.0. For ICM2SHELL, Onapsis writes that "No credentials, no user interaction and no misconfiguration are required," and that WebSocket support is on by default even when no application uses it. Onapsis says it gave SAP a working exploit that runs code end to end without a login.

Not reported: As of publication, Onapsis says it has "not observed active in-the-wild exploitation" of ICM2SHELL or PROXYGATE. None of the sources we read says whether the SAML2 flaw has been exploited.

Not known: How many SAP systems are reachable from the internet. Also, SAP's notes sit behind an SAP for Me login, so the version details below come from SAP's public bulletin and the researchers' advisories. Confirm them against the notes before you schedule work.

Which SAP systems are affected

ICM and Web Dispatcher (ICM2SHELL). Onapsis says this covers any AS ABAP system on kernel 7.40 or higher and any Web Dispatcher. A system running only AS Java is not affected, but dual-stack systems are. Kernel 7.22 is not affected. RedRays adds that the Web Dispatcher in SAP HANA XS Classic and XS Advanced is affected, and SAP Content Server is not.

SAP Gateway (PROXYGATE). This covers ABAP, AS Java, dual-stack and standalone gateways. Whether you are exposed depends on your configuration as well as your patch level (see the next section).

SAML2 (CVE-2026-120017). RedRays, reading SAP Note 3849308, lists "SAP_BASIS 702, 731, 740, 750 to 816, 804, 918 and 920 to 922." RedRays says affected systems "did not verify signatures on incoming assertions," and advises treating any AS ABAP system that uses SAML2 for browser logon as in scope until you prove it is not.

Out-of-maintenance kernels. Onapsis says kernels 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 are affected and may never get a fix. For the Gateway flaw, kernels 7.20 and 7.21 join that list. These kernels have to be upgraded to a maintained version.

How to check SAP Gateway for PROXYGATE

Onapsis gives a check order. Your patch level is not the first thing to look at:

1. A prxyinfo file exists and is permissive (a broad source network, or P SOURCE=* DEST=*): Onapsis calls the system vulnerable regardless of patch level or parameters.
2. A prxyinfo file exists and is restrictive: not exploitable from untrusted networks, but apply SAP's fix anyway in case the file is ever removed.
3. No prxyinfo file: the parameter gw/acl_mode_proxy decides. Onapsis says it "ships disabled (0), which means allow-all: the system is vulnerable." Setting it to 1 makes the default restrictive.

Hardened secinfo and reginfo files do not protect you from this flaw. The minimum kernel patch levels Onapsis lists:

Onapsis says kernels 7.93 and 9.16 already support the parameter, so the fix there is setting gw/acl_mode_proxy to 1, with no new kernel needed. On the patched kernels, set it to 1 after patching, on every application server.

How to check ICM and Web Dispatcher for ICM2SHELL

• Patch paths (per RedRays): SAPWEBDISP.SAR for a standalone Web Dispatcher; dw.sar or the SP Stack Kernel for embedded instances; HANA XS Classic needs SPS08 revision 089.05 or SPS07 revision 079.11.
• Watch kernel 7.93: Onapsis warns that patch level 419 is still affected, so on 7.93 a higher number does not guarantee a fix. It lists 401 and 420 as fixed levels.
• Web Dispatcher shield: Onapsis says a patched Web Dispatcher (7.53 PL 1629, 7.54 PL 723, 7.93 PL 430, 9.16 PL 200 or higher) can protect back-end systems, but only if they cannot be reached any other way. It does not work when the dispatcher is set up as a router (PROT=ROUTER).
• Last resort: Setting icm/HTTP/support_websocket_upgrade=FALSE and restarting blocks the bug. SAP warns this "has a significant impact on interactive and integration scenarios." To see whether you use WebSocket at all, search the ICM or Web Dispatcher HTTP log for status code 101.
• Signs of trouble: unexpected restarts in dev_icm or dev_webdisp, or the process ID changing outside planned maintenance.

How to check SAML2 single sign-on

RedRays says there is no workaround, so patching is the only fix. To check whether SAML2 is on, request /sap/saml2/sp/metadata?sap-client=<client> on each host. If it returns service provider metadata, SAML2 is enabled for that client. Review every trusted identity provider in transaction SAML2, and search the security audit log for privileged users logging on through SAML from unexpected sources.

SAP patch checklist for this week

Why this matters for a business

SAP usually runs the core of a company: finance, orders, inventory and payroll. Onapsis says an attacker who takes over the Gateway could "recover database credentials and other secrets from the secure store and profiles" and collect RFC destinations to move laterally "to both SAP and non-SAP systems connected to the target." It also warns of persistent access and of attackers stopping the system or destroying data. The ICM flaw is also a crash risk: Onapsis says it crashes the ICM or Web Dispatcher process "with a single connection on every release tested."

SAP NetWeaver vulnerability questions people are asking

Are the SAP CVSS 10.0 flaws being exploited?

Not as far as the researchers know. Onapsis says it has not seen ICM2SHELL or PROXYGATE exploited, and no source we read reports attacks on the SAML2 flaw.

Is patching the SAP kernel enough for CVE-2026-89103?

No. Onapsis says the patch alone does not protect you without a restrictive prxyinfo file or gw/acl_mode_proxy set to 1.

Can I disable WebSocket instead of patching?

Only as a temporary step. It blocks ICM2SHELL, but SAP warns it affects interactive and integration scenarios, so check the HTTP log for code 101 first.

Is there a workaround for the SAP SAML2 flaw?

No. RedRays says patching with Note 3849308 is the only fix.

Does this affect SAP HANA?

Yes, if it runs the built-in XS Web Dispatcher. Both XS Classic and XS Advanced are listed.

The bigger lesson

On the Gateway flaw, the patch level alone does not tell you if you are exposed. A fully patched system can still be open because of one configuration file, so patching has to include checking settings, not just installing updates.

If you want help hardening servers and checking settings like these, see security hardening or request a quote.

Get security alerts by email, with the free checklist, at security alerts.

Sources: SAP Security Patch Day November 2026; Onapsis ICM2SHELL advisory; Onapsis PROXYGATE advisory; RedRays SAML2 analysis; RedRays Web Dispatcher analysis.