SAP patches ICM2SHELL, PROXYGATE and SAML2 flaws | Magica
SAP fixes four maximum-severity flaws as Gateway protection requires configuration checks
Editorial Team
••📖7 min read
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Four SAP security flaws carry the maximum CVSS score of 10.0.
ICM2SHELL affects both the web traffic handler and Web Dispatcher reverse proxy.
PROXYGATE can remain exploitable after patching if Gateway proxy controls are permissive.
Onapsis says it had observed no exploitation of either named vulnerability at publication.
SAP, the German business software company, released fixes on November 10 for four vulnerabilities rated at the maximum severity of 10.0 in the infrastructure behind its enterprise applications. Customers must identify every affected component and verify its configuration: installing an updated kernel does not, by itself, complete every PROXYGATE remediation.
SAP published 35 new security notes; the highest CVSS rating is 10.0. Note counts do not equal individual vulnerability counts. Graphic: Magica; sources: SAP and Onapsis. Source: SAP.
Four flaws beneath the business applications
SAP’s November bulletin lists 35 new security notes, four GitHub security advisories and three updates to earlier notes. Four entries receive the maximum Common Vulnerability Scoring System (CVSS) score of 10.0. These publication counts are not a one-to-one count of vulnerabilities; some notes cover multiple CVEs. The bulletin also contains five other critical notes, so the four highest-scoring flaws do not exhaust the urgent patching work.
NetWeaver underpins SAP’s business software, handling functions including integration, authentication, user management and data processing, as described in the report. Its Internet Communication Manager, or ICM, handles incoming web traffic. Web Dispatcher routes web requests to SAP systems. The native SAP Gateway handles remote function calls between systems and can start helper programs on its host.
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
CVE-2026-76964, part of ICM2SHELL
NetWeaver AS ABAP Internet Communication Manager
3778530
CVE-2026-89126, part of ICM2SHELL
Web Dispatcher
3778556
CVE-2026-89103, PROXYGATE
SAP Gateway
3798345
CVE-2026-120017
NetWeaver AS ABAP and ABAP Platform SAML2 Service Provider
3849308
The SAML2 flaw involves missing authentication. Under certain configurations, unauthenticated attackers could submit crafted data to impersonate arbitrary users, potentially compromising the system, according to the report. The available reporting does not specify those configuration conditions.
Onapsis, the enterprise application security vendor that discovered and reported the other three flaws, supplies their detailed technical accounts in its research advisory. It describes a longstanding coordinated-disclosure relationship with SAP and also sells assessment and threat-detection products for affected environments. It says it demonstrated unauthenticated remote code execution for both ICM2SHELL and PROXYGATE to SAP. Those demonstrations establish technical feasibility; they are separate from evidence of attacks against customers.
ICM2SHELL exposes the network edge
In its ICM2SHELL advisory, Onapsis describes memory corruption when the SAP kernel reassembles fragmented WebSocket messages. ICM and Web Dispatcher share the affected code. An attacker able to reach their HTTP or HTTPS ports can crash the process or potentially execute operating-system commands without credentials or user interaction.
Onapsis says it supplied SAP with a working exploit executing commands as <sid>adm, the account owning the SAP installation. Onapsis warns that this access can expose database credentials, connections to other systems, and financial, personnel, supply-chain and customer data, as well as allow changes to business transactions. It also says the crash condition reproduced on every kernel release tested; that does not establish successful code execution on every release.
WebSocket, which keeps a two-way connection open between client and server, is enabled by default, so an organization need not actively use WebSocket applications to be exposed. Onapsis says some default services in SAP’s S/4HANA enterprise applications accept these connections without authentication; other paths reach the flaw before authentication. Web Dispatcher processes the vulnerable messages itself: placing it in front of a backend does not automatically shield the installation. Repeated crashes can interrupt web applications and APIs; a Web Dispatcher outage can affect every SAP system behind it.
Onapsis identifies NetWeaver AS ABAP systems running kernel 7.40 or higher and affected Web Dispatchers, including those embedded in HANA XS. AS Java alone is outside ICM2SHELL’s scope, while dual-stack installations remain affected through their ABAP stack. Affected releases outside maintenance require an upgrade to a supported kernel. Kernel 7.22 is outside ICM2SHELL’s scope, although it needs attention for PROXYGATE.
Patch verification also has an exception: Onapsis says kernel 7.93 patch level 419 remains affected even though the updated patch level 401 Stack Kernel includes the fix. Patch level 420 or higher also fixes it. Administrators must check the applicable release guidance rather than assume that any numerically higher patch is safe.
PROXYGATE turns on a different trust decision
Onapsis’s PROXYGATE advisory describes an attacker making Gateway treat external requests as though they originated from an internal application server. That can authorize operating-system commands as the SAP installation owner without a login.
Exposure depends on the proxy access-control list, prxyinfo. Hardening the better-known secinfo and reginfo lists does not stop this attack. A restrictive proxy policy prevents exploitation from untrusted networks, although an attacker who first compromises a trusted host or network segment could still reach the flaw. A permissive policy can leave a system exposed regardless of patch level. Onapsis stresses that this is a kernel vulnerability whose exploitability depends on configuration, rather than simply an access-list misconfiguration.
When prxyinfo is absent, gw/acl_mode_proxy controls the fallback policy on kernels supporting that parameter. Onapsis says the backward-compatible default of 0 permits all proxy connections. Setting it to 1 makes that fallback restrictive.
The required action varies by release. Kernels 7.93 and 9.16 already support the parameter and need it set to 1 without a new kernel for this fix. Kernels 7.22, 7.53, 7.54, 7.77 and 8.04 need a patch to add support, followed by the setting change. Kernels 9.20 and 9.21 receive patches with no additional manual activity listed by SAP. An explicitly permissive proxy file still requires attention. Gateway installations on ABAP, Java, dual-stack and standalone systems all need assessment.
Onapsis’s PROXYGATE patch table. Proxy-policy restrictions and, where required, gw/acl_mode_proxy = 1 also matter; kernels 7.93 and 9.16 already support that parameter. Source: Onapsis.
Verify protection across the installation
Earlier NetWeaver attacks demonstrate the stakes, without establishing exploitation of these November flaws. A May 2025 alert from the Canadian Centre for Cyber Security described an emergency NetWeaver Visual Composer update followed by a second patch removing residual risk. The agency also noted both vulnerabilities’ inclusion in the US known-exploited catalog. The alert also cited reports of exploitation of CVE-2025-31324 dating back to March 2025, before the emergency update. It concerns different vulnerabilities and does not establish attacks using ICM2SHELL or PROXYGATE.
For ICM2SHELL, Onapsis prioritizes internet-facing Web Dispatchers and ICMs, followed by internal systems, and calls for fixes on every application server. Disabling WebSocket support and restarting the component is a temporary option with potential effects on interactive and integration features. A patched Web Dispatcher can shield backends only at specified higher patch levels and only when all backend access passes through it; router-mode configurations are excluded.
For PROXYGATE, teams need to verify the proxy file, fallback parameter and kernel together on every application server. Onapsis says SAP lists no official workaround, although a restrictive proxy file reduces exposure pending patching. Onapsis advises testing proxy-policy changes because legitimate gateway-to-gateway traffic may depend on existing rules. Restricting network access also reduces exposure without repairing the flaw; any Gateway reachable from the internet needs that exposure closed.
While the rollout proceeds, Onapsis recommends investigating unexpected ICM or Web Dispatcher crashes and restarts. Its advisory says exploitation attempts are likely to cause at least one crash, but a crash alone does not prove an attack.
At publication on November 10, Onapsis’s two advisories reported no observed exploitation in the wild. That limits what its monitoring had detected; it does not establish that attacks were absent. The immediate test for customers is whether reachable components have received the complete applicable fix, including configuration changes, rather than whether a patch installation succeeded.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
