SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.

Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.

The flaws in the Web Dispatcher and the Internet Communication Manager (ICM), which handles the server's web traffic, could allow an attacker who can reach the software over the network to run code, the vendor says.

The flaw in the server's SAML 2.0 service provider, which hands off user sign-in to an identity provider, could allow an attacker to log in as any user on some systems that use SAML single sign-on.

The flaw in SAP Gateway, which connects the server to other SAP systems and programs, could allow an attacker to impersonate one of the system's own servers and take unauthorized actions.

None of the four require any user action to work.

Affected Versions and SAP Notes

Each flaw is fixed in its own note, and the affected versions differ by component, according to SAP's November security bulletin. The notes are in SAP for Me, which requires a sign-in, and the vendor strongly recommends applying them as a priority.

Kernels that are out of maintenance are affected too, according to Onapsis, an SAP security company whose researchers found the ICM, Web Dispatcher and Gateway flaws. Its ICM2SHELL advisory lists kernels 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 for the ICM and Web Dispatcher flaws, and its PROXYGATE advisory lists the same kernels plus 7.20 and 7.21 for the Gateway flaw. These kernels may not get a fix and need an upgrade to one that is still maintained.

What Each Flaw Allows

On the affected SAML setups, an attacker could use CVE-2026-120017 to log in as privileged users too, according to the vendor. A full compromise could follow, possibly reaching connected systems.

A different SAML flaw in the same software, CVE-2026-44748, was fixed on June 9 and needed an attacker with a normal user account.

In the ICM flaw (CVE-2026-76964) and the Web Dispatcher flaw (CVE-2026-89126), crafted network traffic could corrupt memory. An attacker who succeeds could then run code and fully compromise the system.

Onapsis says both flaws come from one bug, which it calls ICM2SHELL, in kernel code the ICM and Web Dispatcher share for putting split WebSocket messages back together. It gave the vendor a working exploit that runs operating system commands as <sid>adm, the account that owns the SAP installation.

The same bug can crash either component, and a crashed Web Dispatcher cuts off every SAP system behind it while it restarts. WebSocket support is on by default, so a system is exposed even if nothing uses it, and dual-stack systems are affected through their ABAP stack. The company's researchers have not seen the bug exploited in attacks.

SAP Gateway uses access control lists to decide which outside programs may connect to it, which programs it may start and which connections it may relay for others. In CVE-2026-89103, the gateway enables its default list with high privileges, allowing an external attacker to be treated as one of the system's own application servers. That attacker could then take unauthorized actions in the application environment.

The researchers who found the flaw call it PROXYGATE. They say exposure depends on the gateway's proxy list, prxyinfo, or on a profile parameter where that list is missing, not on the secinfo and reginfo lists that most hardening guidance covers. Where the proxy settings allow it, crafted requests make the gateway treat an outside attacker as one of its own application servers, and it could then run operating system commands for the attacker as <sid>adm.

The flaw affects any system that runs a gateway, including AS Java, dual-stack and standalone gateway installations. The researchers demonstrated the attack end to end in a proof of concept shared with the vendor, and they have not seen it exploited in attacks.

What to Do

In its Patch Day analysis, RedRays, a company that reviewed the notes in SAP for Me today, advises updating the kernel and all Web Dispatchers in a single rollout. That rollout should reach levels that cover all 17 of this month's kernel and Web Dispatcher fixes.

The firm's guidance for each flaw, except where another source is named:

• SAML2 (CVE-2026-120017). Under certain configurations, the service provider did not check signatures on incoming assertions. Treat any AS ABAP system that uses SAML2 for browser logon, such as Fiori Launchpad or Web GUI behind an identity provider, as in scope until shown otherwise. There is no workaround, so the correction instructions or the listed support package are the only fix. The firm's SAML2 analysis also suggests reviewing every trusted identity provider in transaction SAML2 and checking audit logs for SAML logons by privileged users from unexpected sources.
• SAP Gateway (CVE-2026-89103). Onapsis advises checking the proxy list, prxyinfo, first. A permissive one, open to broad networks or any host, leaves a system exposed at any patch level, so restrict it, starting with gateways that can be reached from the internet. Where there is no prxyinfo file, the profile parameter gw/acl_mode_proxy decides, and it ships set to 0, which allows every proxy connection. Kernels 7.93 and 9.16 already have the parameter and need it set to 1, kernels 7.22, 7.53, 7.54, 7.77 and 8.04 gain it with the kernel patch, and 9.20 and 9.21 also get a kernel patch. The kernel patch alone, without a restrictive prxyinfo or gw/acl_mode_proxy set to 1, does not take a system out of scope. There is no official workaround, but a restrictive prxyinfo reduces exposure until the patch is in, and the firm also advises limiting the gateway ports (33NN and 48NN) to hosts that need RFC access.
• ICM (CVE-2026-76964). WebSocket control frames with invalid length fields cause a heap out-of-bounds write before any login. SAP NetWeaver AS Java is not affected, and the fix ships through dw.sar and the SP Stack Kernel. If users reach the ICM only through a Web Dispatcher, patching that Web Dispatcher to the levels in FAQ note 3778788 shields the ICM for now, according to RedRays' ICM analysis. That holds only if nobody can reach the ICM ports directly. The ICM2SHELL advisory adds that the shield does not work on a Web Dispatcher set up as a router (PROT=ROUTER). It also warns that on release 7.93 a higher patch level is not always a fixed one: patch level 419 is still vulnerable, and only the updated 401 Stack Kernel, 402 once released, and 420 or later carry the fix. Turning off WebSocket support blocks the bug as a last resort, but it breaks features that depend on it.
• Web Dispatcher (CVE-2026-89126). It has the same root cause as the ICM flaw. It affects standalone and embedded Web Dispatchers, including those in SAP HANA XS Classic and XS Advanced, but not SAP Content Server. The firm's Web Dispatcher analysis lists the patch paths: SAPWEBDISP.SAR for standalone instances, dw.sar or the SP Stack Kernel for embedded ones, SPS08 revision 089.05 or SPS07 revision 079.11 for HANA XS Classic, and version 1.5.4 or later for XS Advanced. Turning off WebSocket support works until the patch is in, but the note warns that this affects ABAP Push Channels and some Fiori features. Find every Web Dispatcher first, because one missed instance leaves the flaw open.

(The story was updated after publication on November 10, 2026, to include details from the researchers who found the ICM, Web Dispatcher and Gateway flaws.)

Corrected on November 10, 2026: an earlier version tied the SAP Gateway flaw to the secinfo and reginfo lists and said kernels from 7.93 on already have the gw/acl_mode_proxy parameter, but the researchers who found the flaw say the proxy list, prxyinfo, or that parameter decides exposure, and kernel 8.04 gets the parameter only with the patch.