Skip to content
eastbaycyber

Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.

SAP patches four CVSS 10.0 flaws in NetWeaver and related products

Breaking news 5 min read
EC
East Bay Cyber Editorial Team Updated Developing story
Built from the vendor or authority notice plus independent reporting; unconfirmed claims are labeled as reported. Human-reviewed after publishing.

CVE explainers: CVE-2026-120017

TL;DR - SAP released 35 new security notes and 4 GitHub security advisories on 10 th of November 2026. - Four listed vulnerabilities have a Critical priority and CVSS 10.0 ratings. - The affected components include SAP NetWeaver AS ABAP, SAP Web Dispatcher, SAP Gateway and the SAML2 service provider. - Onapsis reports remote code execution for the ICM, Web Dispatcher and Gateway vulnerabilities. - SAP strongly recommends visiting the support portal and applying patches on priority.

What happened#

SAP’s November 2026 Security Patch Day included 35 new security notes, 4 GitHub security advisories and 3 updates to previously released security notes, according to SAP.

Four of the new notes have Critical priority and a CVSS score of 10.0:

SAP Note Vulnerability Product
3778530 CVE-2026-76964, memory corruption SAP NetWeaver AS ABAP, Internet Communication Manager
3778556 CVE-2026-89126, memory corruption SAP Web Dispatcher
3798345 CVE-2026-89103, broken access control SAP Gateway
3849308 CVE-2026-120017, missing authentication SAP NetWeaver AS ABAP and ABAP Platform, SAML2 Service Provider

The SAP bulletin lists additional Critical vulnerabilities, including a 9.9 CVSS code injection issue in SAP NetWeaver Knowledge Management and a 9.9 CVSS OS command injection issue in the ABAP Application Server. The four CVSS 10.0 issues are the focus of this advisory.

Onapsis gives the ICM and Web Dispatcher issues the name ICM2SHELL. It reports that the vulnerabilities involve shared kernel code handling WebSocket traffic and that a specially crafted sequence of messages can cause memory corruption. Onapsis also reports that it provided SAP with a working exploit for unauthenticated remote code execution as the <sid>adm account. Those technical details are described in the ICM2SHELL advisory.

For CVE-2026-89103, Onapsis reports that an unauthenticated attacker with network access can exploit SAP Gateway behavior under certain proxy access-control configurations to run operating system commands as <sid>adm. Its technical description appears in the PROXYGATE advisory.

Are you affected#

Affected versions differ by component. SAP’s bulletin lists the following products and versions:

  • CVE-2026-76964: KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20.
  • CVE-2026-89126: HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20.
  • CVE-2026-89103: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21.
  • CVE-2026-120017: SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 920, SAP_BASIS 921, SAP_BASIS 922.

Onapsis reports that the ICM and Web Dispatcher issues also affect additional kernel versions, including kernels out of maintenance. It lists kernel versions 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 for those issues. For PROXYGATE, Onapsis lists those versions plus 7.20 and 7.21. This information is reported by Onapsis and is not included in SAP’s public bulletin excerpt.

A version match alone may not determine exposure for CVE-2026-89103. Onapsis says exploitability depends on the Gateway proxy access-control list, prxyinfo, and the behavior when that list is missing. SAP’s fix, according to Onapsis, combines a kernel patch with setting the profile parameter gw/acl_mode_proxy = 1 on most kernel releases.

What is confirmed and what is reported#

Claim Source Status
SAP released 35 new security notes and 4 GitHub security advisories on 10 th of November 2026. SAP Confirmed
CVE-2026-76964, CVE-2026-89126, CVE-2026-89103 and CVE-2026-120017 each have Critical priority and a CVSS score of 10.0. SAP Confirmed
The four vulnerabilities affect the products and versions listed in SAP’s November bulletin. SAP Confirmed
CVE-2026-76964 and CVE-2026-89126 can enable remote code execution through crafted network traffic. The Hacker News Reported
Onapsis provided SAP with a working exploit for unauthenticated remote code execution in the ICM and Web Dispatcher issues. Onapsis Reported
CVE-2026-89103 can enable unauthenticated remote code execution under applicable Gateway proxy access-control conditions. Onapsis Reported
Onapsis had not observed active in-the-wild exploitation of the ICM2SHELL and PROXYGATE vulnerabilities as of its publication dates. Onapsis, Onapsis Reported

What defenders should do now#

  1. Inventory SAP NetWeaver AS ABAP, SAP Web Dispatcher, SAP Gateway and SAML2 Service Provider deployments against the affected versions listed in SAP’s bulletin.
  2. Review SAP Notes 3778530, 3778556, 3798345 and 3849308 in the SAP support portal for the applicable remediation details.
  3. Follow SAP’s recommendation to apply the relevant patches on priority.
  4. For SAP Gateway deployments, review the prxyinfo proxy access-control list and the gw/acl_mode_proxy setting as part of exposure assessment, based on the configuration guidance described by Onapsis.
  5. For ICM and Web Dispatcher systems, assess whether HTTP or HTTPS ports are reachable by untrusted networks and prioritize systems exposed at the network edge.
  6. Check whether systems use kernel versions identified by Onapsis as out of maintenance, and review the vendor’s available remediation path for those deployments.
  7. Monitor SAP support communications and Onapsis updates for additional technical details or exploitation observations.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

Last verified: 2026-11-10

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.