SAP has released fixes for PROXYGATE and ICM2SHELL, critical security flaws that could let attackers take control of SAP systems without signing in.
Disclosed during the November 10, 2026, Security Patch Day, the vulnerabilities carry maximum CVSS scores of 10.0 and affect core components used across business applications. Onapsis Research Labs discovered and reported both issues.
The flaws allow attackers with network access to run operating system commands under the
This gives them control over the affected SAP environment, though it does not automatically mean root access to the underlying server. Business data, stored credentials, application settings, and system availability could all be at risk.
PROXYGATE Targets SAP Gateway Trust
PROXYGATE, tracked as CVE-2026-89103, affects the SAP Gateway, a component that handles communication between SAP systems and external programs. Unlike problems caused by weak gateway rules, this kernel vulnerability can remain exploitable even when administrators have secured the commonly checked secinfo and reginfo access control lists.
The weakness lies in how the gateway decides whether a request comes from a trusted internal server. When its proxy policy allows the connection, crafted requests can make an outside attacker appear internal. The gateway then accepts requests that its existing rules permit for trusted systems, potentially starting commands chosen by the attacker.
Exposure depends on the less commonly reviewed prxyinfo proxy access list and related settings. A restrictive policy blocks exploitation from untrusted networks, while permissive or missing rules can leave systems exposed.
The affected gateway runs across ABAP, AS Java, dual-stack, and standalone deployments, widening the scope beyond a single application type.
ICM2SHELL Affects Web Traffic Handling
According to the Onapsis ICM2SHELL advisory, the second flaw involves memory corruption in shared SAP kernel code that processes WebSocket traffic. CVE-2026-76964 affects Internet Communication Manager, while CVE-2026-89126 affects SAP Web Dispatcher, including its SAP HANA XS component. Cybersecurity News’s November SAP patch coverage also identifies the critical ICM issue.
Attackers who can reach an affected HTTP or HTTPS port could corrupt process memory, execute commands, or crash the service. WebSocket support is enabled by default, even where organizations do not actively use it.
Some SAP S/4HANA services accept WebSocket connections without authentication, removing the need for stolen credentials or user interaction.
Onapsis reported no observed exploitation of either vulnerability at publication. That does not establish that all environments are safe. Earlier, unrelated SAP attacks show the potential business impact, including the NetWeaver compromise used to deploy Auto-Color malware. Those incidents are separate from PROXYGATE and ICM2SHELL.
The PROXYGATE technical advisory warns that patching alone may not resolve exposure. Most affected kernel releases require the relevant update plus gw/acl_mode_proxy = 1. Administrators must also restrict permissive prxyinfo rules. Unsupported kernels need an upgrade to a maintained, compatible release, and changes must cover every application server.
SAP addresses ICM2SHELL through Security Notes 3778530 and 3778556. Teams should prioritize exposed Web Dispatcher and ICM services, then verify fixes across their SAP estate.
Gateway access should be limited to hosts that need it. Network restrictions reduce exposure, but they do not replace complete patching and required configuration changes.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
