SAP November 2026 Patch Day: four unauthenticated CVSS 10.0 flaws in NetWeaver, Web Dispatcher and Gateway (ICM2SHELL, ProxyGate)

Linha do tempo

1. cert.cyber.gouv.fr ↗ · pub. 09/11/2026 21:00 · coletado 10/11 13:04

   SAP Patch Day de novembro de 2026: falhas em NetWeaver, Web Dispatcher e Gateway, quatro com CVSS 10.0

   ler a análise desta fonte ocultar

   Em 10 de novembro de 2026, a SAP publicou seu boletim mensal de segurança, e o CERT-FR (cert.cyber.gouv.fr) o repassou no aviso CERTFR-2026-AVI-1497. O aviso cobre dezenas de produtos, incluindo SAP NetWeaver (AS ABAP, Message Server, Internet Communication Manager, SAML2 Service Provider), SAP Web Dispatcher, SAP Gateway, Business Objects e S4CRM, e lista 45 identificadores CVE sem vinculá-los a um produto específico. Segundo a imprensa especializada, o boletim trouxe 35 novas notas de segurança, quatro GitHub Security Advisories e três atualizações de notas anteriores (cybersecuritynews.com). Quatro falhas receberam a pontuação máxima de CVSS 10.0, todas exigindo nenhuma credencial e nenhuma interação do usuário: CVE-2026-76964 (corrupção de memória no Internet Communication Manager do NetWeaver AS ABAP, nota 3778530), CVE-2026-89126 (Web Dispatcher, nota 3778556), CVE-2026-89103 (quebra de controle de acesso no Gateway, nota 3798345) e CVE-2026-120017 (autenticação ausente no SAML2 Service Provider, nota 3849308) (cybersecuritynews.com). O aviso do CERT-FR não informa pontuação CVSS, vetor, pré-requisitos nem exploração ativa. A página do boletim da SAP não pôde ser aberta durante a pesquisa, e nenhuma fonte consultada relata exploração em campo, por isso a urgência é alta: a combinação de CVSS 10.0 sem autenticação em componentes de rede do NetWeaver justifica prioridade máxima de correção.

   Detalhes Técnicos

   O aviso do CERT-FR associa às falhas efeitos de execução de código arbitrário remoto, negação de serviço remota e perda de confidencialidade de dados, sem especificar o componente de cada CVE. Segundo a imprensa, as falhas críticas tratam de corrupção de memória, falta de autenticação, quebra de controle de acesso e injeção de código (cybersecuritynews.com). A CVE-2026-76964 afeta KRNL64UC 7.53 e KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 e 9.20 (cybersecuritynews.com). Os três avisos com nota 9.9 são CVE-2026-109803 (NetWeaver Knowledge Management, XML Forms), CVE-2026-76965 (ABAP Application Server) e CVE-2026-109795 (S4CRM), e exigem privilégios baixos (cybersecuritynews.com).

   Remediação

   Aplicar as notas de segurança do boletim november-2026 da SAP em cada sistema afetado, começando pelas quatro falhas com CVSS 10.0 e pelos componentes expostos à rede (Internet Communication Manager, Web Dispatcher, Gateway e SAML2). Como o aviso do CERT-FR não associa cada CVE a um produto, confirmar no boletim da SAP quais notas se aplicam a cada instalação, inclusive o SAP Host Agent, o Solution Tools Plug-In e o astonish (SAP/astonish, versões anteriores à 3.6.0). Verificar a exposição de portais e serviços de Web Dispatcher e Gateway à internet e restringir o acesso enquanto as correções não forem aplicadas.

2. securityweek.com ↗ · pub. 10/11/2026 11:46 · coletado 10/11 12:00

   SAP fixes ICM2SHELL and ProxyGate in November 2026 Patch Day after Onapsis provides working exploit

   This article adds that Onapsis says it gave SAP a working exploit for full unauthenticated RCE through ICM2SHELL, and that the denial-of-service reproduced on every kernel release it tested. It also places the ProxyGate gateway flaw on AS Java, dual-stack and standalone-gateway systems and on kernels already out of maintenance, and it gives a count of 42 new and updated notes (43 per Onapsis) that differs from the 35-note figure in the existing report. No in-the-wild exploitation is reported.

   ler a análise desta fonte ocultar

   This article adds that Onapsis says it gave SAP a working exploit for full unauthenticated RCE through ICM2SHELL, and that the denial-of-service reproduced on every kernel release it tested. It also places the ProxyGate gateway flaw on AS Java, dual-stack and standalone-gateway systems and on kernels already out of maintenance, and it gives a count of 42 new and updated notes (43 per Onapsis) that differs from the 35-note figure in the existing report. No in-the-wild exploitation is reported.

   SAP released 42 new and updated security notes on its November 2026 Patch Day, nine of them rated Critical, including four maximum-severity flaws in SAP NetWeaver, SAP Web Dispatcher and SAP Gateway (securityweek.com). Two of those flaws, CVE-2026-76964 and CVE-2026-89126, form the ICM2SHELL weakness in the kernel component that handles HTTP, HTTPS and WebSocket traffic, which Onapsis says is triggered by a crafted sequence of fragmented WebSocket messages and can crash the process or corrupt its memory. Onapsis says its research labs gave SAP a working exploit for full unauthenticated remote code execution as <sid>adm, and the denial-of-service condition reproduced on every SAP Kernel release it tested. The SAP Gateway flaw CVE-2026-89103 (ProxyGate) abuses an access-control list left open, letting an unauthenticated attacker pass as an internal request and run OS commands, and Onapsis says it reaches kernels out of maintenance and AS Java, dual-stack and standalone-gateway systems. The article reports no in-the-wild exploitation, so the urgency rests on the unauthenticated reach of these flaws and the working exploit that Onapsis describes.

3. gbhackers.com ↗ · pub. 10/11/2026 09:01 · coletado 10/11 10:00

   SAP November 2026 Patch Day fixes four CVSS 10.0 flaws in NetWeaver, Web Dispatcher, Gateway and SAML2

   The article adds CVE-2026-109799, an improper JWT signature verification flaw in the Python SDK IASContextProvider affecting versions before 0.63.1, together with the GitHub advisory fixes bundled with it (gbhackers.com). It also names CVE-2026-120014 as the second identifier of the 9.6 CSRF note covering the Web Dispatcher and ICM. It reports no exploitation of any of these flaws.

   ler a análise desta fonte ocultar

   The article adds CVE-2026-109799, an improper JWT signature verification flaw in the Python SDK IASContextProvider affecting versions before 0.63.1, together with the GitHub advisory fixes bundled with it (gbhackers.com). It also names CVE-2026-120014 as the second identifier of the 9.6 CSRF note covering the Web Dispatcher and ICM. It reports no exploitation of any of these flaws.

   SAP released its November 2026 Security Patch Day on 10 November 2026, with 35 new security notes, four GitHub security advisories and three updates to earlier notes (gbhackers.com). Four flaws carry the maximum CVSS score of 10.0 and sit in the SAP NetWeaver Internet Communication Manager, SAP Web Dispatcher, SAP Gateway and the SAML2 Service Provider of SAP NetWeaver AS ABAP; all four are reachable over the network without privileges or user interaction, and the article reports no exploitation. Three further critical notes score 9.9, and a CSRF note covering CVE-2026-89119 and CVE-2026-120014 scores 9.6. The release also carries a GitHub advisory for CVE-2026-109799, an identity-spoofing flaw in the Python SDK, so the criticity reflects unauthenticated reach into internet-facing components rather than confirmed attacks.

   Technical Details

   • CVE-2026-120017 (SAML2 Service Provider, SAP NetWeaver AS ABAP and ABAP Platform): the product does not sufficiently verify incoming authentication assertions under certain configurations, so an unauthenticated attacker can impersonate arbitrary users, including privileged accounts (strix.ai). The weakness is classified as CWE-347 (nki.gov.hu). Systems that use SAML2 for browser logon, such as Fiori Launchpad or Web GUI behind an identity provider, are in scope, and no workaround exists.
   • CVE-2026-89126 (SAP Web Dispatcher): insufficient validation of network input causes memory corruption, classified as CWE-122, with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (strix.ai). It affects standalone and embedded Web Dispatchers, including those in SAP HANA XS Classic and XS Advanced. Turning off WebSocket support works until the patch is in, but it disables ABAP Push Channels and some Fiori features.
   • CVE-2026-76964 (ICM, SAP NetWeaver): WebSocket control frames with invalid length fields cause a heap out-of-bounds write before any login. SAP NetWeaver AS Java is not affected.
   • CVE-2026-89103 (SAP Gateway): the default access control list runs with high privileges, so an external attacker can be treated as one of the system's own application servers when secinfo and reginfo lack explicit rules. The note lists no workaround.
   • CVE-2026-109799 (Python SDK, IASContextProvider): improper JWT signature verification enables tenant or user identity spoofing in versions before 0.63.1 (gbhackers.com). Its GitHub advisory also covers separate fixes for path traversal in the Python agent-memory component, information disclosure in the JavaScript AI SDK and cross-tenant sandbox takeover in SAP/astonish (gbhackers.com).

   Remediation

   • Apply the November 2026 SAP Security Notes, starting with the four CVSS 10.0 issues on internet-reachable systems, then the 9.9 low-privilege code execution bugs (securityonline.info). Check each individual note for its exact affected support packages rather than relying on affected-version lists (gbhackers.com).
   • For SAP Gateway, after patching, verify that gw/acl_mode is 1 and that secinfo and reginfo hold explicit rules, and block the gateway port from user networks and the internet (securityonline.info).
   • Where a patch cannot be applied at once, restrict network access to the SAP Gateway, Web Dispatcher and ICM ports and review SAML2 settings on ABAP systems (securityonline.info).
   • Developers using the Python SDK should move to version 0.63.1 or later, the first version the article does not list as affected (gbhackers.com).
4. bleepingcomputer.com ↗ · pub. 10/11/2026 09:07 · coletado 10/11 10:00

   SAP November 2026 Patch Day fixes four CVSS 10.0 NetWeaver, Gateway and Web Dispatcher flaws, including ICM2SHELL and PROXYGATE

   The article adds researcher attribution and names: Onapsis reported three of the four bugs and groups CVE-2026-76964 and CVE-2026-89126 as ICM2SHELL, with CVE-2026-89103 as PROXYGATE (bleepingcomputer.com). It also places this bulletin in a run of SAP max-severity fixes: CVE-2026-58231 in Commerce Cloud in August, which Defused reported as exploited days after the patch, and the OVERPASS kernel bug CVE-2026-44756 together with CVE-2026-89111 in September and October (bleepingcomputer.com). Finally, it cites CISA's count of 14 SAP flaws flagged as actively exploited since November 2021, three of which ransomware groups abused (bleepingcomputer.com).

   ler a análise desta fonte ocultar

   The article adds researcher attribution and names: Onapsis reported three of the four bugs and groups CVE-2026-76964 and CVE-2026-89126 as ICM2SHELL, with CVE-2026-89103 as PROXYGATE (bleepingcomputer.com). It also places this bulletin in a run of SAP max-severity fixes: CVE-2026-58231 in Commerce Cloud in August, which Defused reported as exploited days after the patch, and the OVERPASS kernel bug CVE-2026-44756 together with CVE-2026-89111 in September and October (bleepingcomputer.com). Finally, it cites CISA's count of 14 SAP flaws flagged as actively exploited since November 2021, three of which ransomware groups abused (bleepingcomputer.com).

   SAP closed its November 2026 Security Patch Day with fixes for 35 vulnerabilities, four of them scored 10/10 on CVSS. Two of the four sit in the SAP NetWeaver Application Server ABAP stack: a missing-authentication defect in the SAML2 Service Provider (CVE-2026-120017) and a heap memory corruption in the Internet Communication Manager (CVE-2026-76964). The remaining pair targets SAP Gateway through a broken access control defect (CVE-2026-89103) and SAP Web Dispatcher through memory corruption (CVE-2026-89126). Onapsis, which reported three of the four, names the ICM and Web Dispatcher bugs ICM2SHELL and the Gateway bug PROXYGATE, and says each lets an outsider take control with no credentials and no user interaction. SAP's own scoring likewise says an unauthenticated attacker can fully compromise the affected systems remotely, while the article does not report any exploitation of these four flaws. According to the CNA record (strix.ai), the SAML2 issue depends on specific configurations, which limits its reach.

5. thehackernews.com ↗ · pub. 10/11/2026 07:02 · coletado 10/11 08:00

   SAP fixes four unauthenticated CVSS 10.0 flaws in NetWeaver, Web Dispatcher and Gateway in November 2026 Patch Day

   The article adds that the vendor rates all four pre-authentication flaws at 10.0, and it names CVE-2026-76964 (ICM) and CVE-2026-89103 (SAP Gateway) among them, alongside CVE-2026-120017 and CVE-2026-89126. It also states that the ICM and Web Dispatcher flaws could let a network attacker run code through crafted traffic, and that none of the four needs user action. It recalls CVE-2026-44748, a SAML flaw fixed on June 9 that required a normal user account.

   ler a análise desta fonte ocultar

   The article adds that the vendor rates all four pre-authentication flaws at 10.0, and it names CVE-2026-76964 (ICM) and CVE-2026-89103 (SAP Gateway) among them, alongside CVE-2026-120017 and CVE-2026-89126. It also states that the ICM and Web Dispatcher flaws could let a network attacker run code through crafted traffic, and that none of the four needs user action. It recalls CVE-2026-44748, a SAML flaw fixed on June 9 that required a normal user account.

   SAP fixed four flaws in its November 2026 Security Patch Day that an attacker can exploit without logging in, and the vendor rates all four at 10.0, the maximum CVSS score. Three sit in the SAP NetWeaver application server, covering the SAML 2.0 service provider, the Internet Communication Manager (ICM) and SAP Gateway, and one sits in the SAP Web Dispatcher, which receives web requests from the internet. The ICM and Web Dispatcher flaws could let a network-reachable attacker run code, the SAML flaw could let an attacker log in as any user on some SAML single sign-on systems, and the Gateway flaw could let an outside party pass as one of the system's own application servers. None of the four needs user action, but each has a limit: the SAML issue depends on certain configurations, the ICM flaw does not affect NetWeaver AS Java, and the Web Dispatcher and Gateway exposure depends on whether the relevant ports can be reached from user networks or the internet. The article does not report exploitation in the wild, but the unauthenticated network reach of code-execution bugs in internet-facing components keeps the urgency critical.

   Technical Details

   • CVE-2026-120017 (SAML2 service provider, SAP NetWeaver AS ABAP and ABAP Platform): under certain configurations the provider does not check signatures on incoming assertions. Any AS ABAP system that uses SAML2 for browser logon, such as Fiori Launchpad or Web GUI behind an identity provider, should be treated as in scope. There is no workaround, so the correction instructions or the listed support package are the only fix. An attacker could log in as privileged users and possibly reach connected systems.
   • CVE-2026-76964 (ICM, SAP NetWeaver): WebSocket control frames with invalid length fields cause a heap out-of-bounds write before any login. SAP NetWeaver AS Java is not affected, and the fix ships through dw.sar and the SP Stack Kernel. Patching the Web Dispatcher shields the ICM only if nobody can reach the ICM ports directly. Turning off WebSocket support blocks the bug but breaks features that depend on it.
   • CVE-2026-89126 (SAP Web Dispatcher): it shares the root cause of the ICM flaw and lets crafted network traffic corrupt memory. It affects standalone and embedded Web Dispatchers, including those in SAP HANA XS Classic and XS Advanced, but not SAP Content Server. Turning off WebSocket support works until the patch is in, but it disables ABAP Push Channels and some Fiori features.
   • CVE-2026-89103 (SAP Gateway): the gateway enables its default access control list with high privileges, so an external attacker can be treated as one of the system's own application servers. Where secinfo and reginfo hold no explicit rules, or rely on the internal host keyword, the fallback rules allow that trust, and the attacker could reach gateway attack paths toward command execution. The note lists no workaround.

   Remediation

   • Patch the kernel and all SAP Web Dispatchers in a single rollout that reaches the levels covering all 17 kernel and Web Dispatcher fixes of the month, as the RedRays analysis advises.
   • Apply the four SAP Notes first, each in its own note in SAP for Me, which requires a sign-in. The vendor strongly recommends prioritizing them.
   • For SAML2, review every trusted identity provider in transaction SAML2 and check audit logs for privileged SAML logons from unexpected sources.
   • For SAP Gateway, after patching, verify that gw/acl_mode is 1 and that secinfo and reginfo hold explicit rules, and block the gateway port (33xx) from user networks and the internet. Kernels up to 7.77 need the profile parameter gw/acl_mode_proxy, which the fix adds, while kernels from 7.93 on already include it.
   • For Web Dispatchers, inventory every instance first, since one missed instance leaves the flaw open. Patch paths are SAPWEBDISP.SAR for standalone instances, dw.sar or the SP Stack Kernel for embedded ones, SPS08 revision 089.05 or SPS07 revision 079.11 for HANA XS Classic, and version 1.5.4 or later for XS Advanced.
   • Where patching cannot happen at once, disabling WebSocket support is the temporary option for the ICM and Web Dispatcher flaws, at the cost of the features listed above.
   • No SAP bulletin page or public pull request was opened during this analysis, so the fix is documented here only through SAP Notes and the RedRays analysis reported in the article.
6. securityonline.info ↗ · pub. 09/11/2026 22:56 · coletado 09/11 23:00 primeiro registro

   SAP November 2026 Patch Day fixes nine Critical flaws, including unauthenticated CVSS 10.0 bugs in NetWeaver and Web Dispatcher

   ler a análise desta fonte ocultar

   SAP published its November 2026 Security Patch Day bulletin on 10 November 2026, with 38 new CVE records, nine rated Critical and four at CVSS 10.0 (securityonline.info). Most of the worst bugs sit in SAP NetWeaver AS ABAP, SAP Web Dispatcher and SAP Gateway, and several need no authentication. The CNA record for CVE-2026-120017 rates it 10.0 with a network vector, low complexity, no privileges and no user interaction (strix.ai, mirroring the cve.org record). Its main limit is that the SAML2 flaw depends on certain configurations, and no exploitation is confirmed: CVE-2026-89126 is not in CISA KEV and no public exploit is recorded at the time of research (thehackerwire.com). Criticity is critical because several unauthenticated CVSS 10.0 bugs sit in internet-reachable SAP components.

   Technical Details

   • CVE-2026-120017 (SAML2 Service Provider, SAP NetWeaver AS ABAP and ABAP Platform): the product does not sufficiently verify incoming authentication assertions under certain configurations, so an unauthenticated attacker can impersonate arbitrary users, including privileged accounts (strix.ai). The weakness is classified as CWE-347 (nki.gov.hu).
   • CVE-2026-89126 (SAP Web Dispatcher): insufficient validation of network input causes memory corruption, classified as CWE-122, with a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (strix.ai).
   • Per the article (securityonline.info), which the vendor pages opened did not confirm in detail: CVE-2026-76964 is a memory corruption bug in the Internet Communication Manager of AS ABAP; CVE-2026-89103 is a default high-privilege access control list in SAP Gateway that lets an outside attacker pass as an internal application server; CVE-2026-76965 (OS command injection in AS ABAP), CVE-2026-109795 (code injection through a remote interface) and CVE-2026-109803 (XSL transformation abuse in Knowledge Management XML Forms) score 9.9 and need only low privileges; CVE-2026-89119 (CVSS 9.6) is a CSRF flaw in Web Dispatcher and ICM that needs an admin to click a malicious link; CVE-2026-109798 (CVSS 9.1) is an XXE bug in SAP BusinessObjects Web Intelligence.
   • Affected components named in the article: SAP NetWeaver AS ABAP and ABAP Platform (SAML2 flaw), SAP Web Dispatcher and kernel releases 7.53, 7.54, 7.77, 7.93 and 9.16 to 9.20, SAP Gateway on kernel 7.22 through 9.21, and the SAP BusinessObjects BI Platform, Host Agent, NetWeaver AS Java and S4CRM components (securityonline.info).

   Remediation

   • Apply the November 2026 SAP Security Notes, checking each note for its exact affected support packages (securityonline.info). The CNA-linked notes for the two headline flaws are SAP Note 3849308 for CVE-2026-120017 (nki.gov.hu) and SAP Note 3778556 for CVE-2026-89126 (thehackerwire.com).
   • Patch the four CVSS 10.0 issues first on systems reachable from the internet, then the 9.9 low-privilege code execution bugs (securityonline.info).
   • Where a patch cannot be applied at once, restrict network access to the SAP Gateway, Web Dispatcher and ICM ports, and review the SAML2 settings on ABAP systems (securityonline.info).
   • The research did not open SAP's own November 2026 bulletin page, so the list of notes and versions is taken from third-party pages. SAP fixes are distributed as SAP Notes, and no public pull request was found, so no Fix Details section is given.

   Conflicting Reports

   • The article gives SAP_BASIS 702 through 920 for CVE-2026-120017 (securityonline.info). The CNA-based records list builds up to SAP_BASIS 922 (strix.ai; radar.offseq.com). The CNA data is the more authoritative source here.
   • The article says CVE-2026-89126 leads to code execution (securityonline.info). The CNA text describes unauthenticated memory corruption without stating code execution (strix.ai), while thehackerwire.com describes it as unauthenticated remote code execution. Treat it as likely RCE until SAP's note has been reviewed.