SAP Security Alert: 4 CVSS 10.0 Flaws Fixed in NetWeaver

SAP's November Patch Day shipped 35 security notes, and four of them carry the maximum CVSS 10.0 rating for flaws that need no login and no user interaction. Three sit in SAP NetWeaver Application Server, the foundation most SAP systems run on, and the fourth is in the Web Dispatcher, the component that receives web traffic from the internet and passes it inward. For SAP security teams, that combination of rating, reachability and core components is close to the worst a monthly bulletin can offer, and it lands at the start of a holiday season when patching slows down everywhere.

Two of the four can end in remote code execution, and the other two let an attacker impersonate a trusted server or sign in as any user on systems using single sign-on. SAP security teams that run NetWeaver or a Web Dispatcher should treat this month's bulletin as an immediate action item rather than a routine patch cycle. The rest of November's list is nearly as serious, and it is covered further down.

The researchers who found three of the flaws, at SAP security company Onapsis, have published working details, and one advisory demonstrates operating system commands running as the SAP installation account. No exploitation has been observed in the wild so far. For SAP security planners, that is the window in which patching is cheap and incidents are not.

The four flaws, in one place

All four are rated CVSS 10.0, the highest score the scale allows, because they combine network reachability, no authentication and the worst-case impact. The table below is the short version, and the SAP security bulletin itself carries the long version with every affected release. Readers who want the primary source can read the full bulletin on SAP's support portal or The Hacker News write-up that gathered the researcher detail.

• CVE-2026-76964, Internet Communication Manager in SAP NetWeaver AS ABAP, fixed in Note 3778530. Crafted network traffic corrupts memory before any login, and a successful attacker can run code and take over the system.
• CVE-2026-89126, SAP Web Dispatcher, fixed in Note 3778556. The same memory corruption, with the same outcome, in the component most likely to face the internet.
• CVE-2026-89103, SAP Gateway, fixed in Note 3798345. Broken access control lets an outside attacker be treated as one of the system's own application servers, which opens the door to unauthorised actions in the application environment.
• CVE-2026-120017, the SAML2 service provider in SAP NetWeaver AS ABAP and ABAP Platform, fixed in Note 3849308. On affected configurations the service provider did not check signatures on incoming assertions, letting an attacker sign in as any user the identity provider recognises, including privileged ones.

The affected version lists are long and differ by component, which is one reason this bulletin needs reading rather than skimming. The SAML2 flaw alone covers SAP_BASIS releases from 702 through 922, a range that includes a decade of systems. SAP security baselines that assume a single kernel level per estate will not survive contact with this list.

ICM2SHELL: one bug, two components

The ICM and the Web Dispatcher share kernel code that reassembles split WebSocket messages, and that shared code contains the bug behind both memory corruption flaws. Onapsis, which found it and named it ICM2SHELL, gave SAP a working exploit that runs operating system commands as the SAP installation administrator account. That proof of concept is why SAP security responses to this bulletin should assume the exploit works rather than hoping the rating is theoretical.

The mechanics are uncomfortable. WebSocket control frames carrying invalid length fields cause a heap out-of-bounds write before any authentication happens, which is why the flaw scores CVSS 10.0 rather than something lower. WebSocket support is on by default, so a system is exposed even if nothing in the business uses WebSockets, and dual-stack installations are affected through their ABAP stack.

There is also a denial of service angle that matters operationally. The same bug can crash either component, and a crashed Web Dispatcher cuts off every SAP system behind it until it restarts. An attacker who only wants downtime, and not access, needs no more than the ability to reach the component over the network. Availability, not just confidentiality, belongs on the SAP security risk register for this one.

AS Java is not affected by the ICM flaw, and neither is SAP Content Server on the Web Dispatcher side. Everything else in the affected kernel list is.

PROXYGATE: the gateway bug hardening guides missed

The Gateway flaw is the one most likely to survive an otherwise well-run security programme, because it lives in a list most hardening guidance does not cover. That is a quiet failure of the SAP security canon rather than of any single team.

SAP Gateway decides which external programs may connect to it through access control lists. Most security guidance focuses on the secinfo and reginfo lists, and many administrators have spent years tightening exactly those. The Gateway flaw works through a different list, prxyinfo, which governs proxy connections, or through the profile parameter gw/acl_mode_proxy when no prxyinfo file exists. That parameter ships set to 0, which allows every proxy connection. Years of SAP security hardening that never touched prxyinfo left the door open without anyone knowing.

Where the proxy settings are permissive, crafted requests make the Gateway treat an outside attacker as one of the system's own application servers, and from there the demonstrated attack runs operating system commands as the installation account. Onapsis demonstrated the attack end to end in a proof of concept shared with the vendor.

The affected scope is wider than the name suggests. Any system running a Gateway is in scope, including AS Java, dual-stack installations and standalone gateways. And the patch alone is not a complete fix: on kernels 7.93 and 9.16 the parameter already exists and must be set to 1, on 7.22, 7.53, 7.54, 7.77 and 8.04 the parameter arrives with the kernel patch, and a restrictive prxyinfo is still needed, because a permissive one leaves a system exposed at any patch level. SAP security checklists that end at applying the note will miss this entirely.

The SAML flaw that ends in a full compromise

The SAML2 flaw is the quiet one with the widest blast radius. On systems that use SAML single sign-on for browser logon, which in practice means Fiori Launchpad or Web GUI sitting behind an identity provider, the missing signature check means an attacker who can reach the service could forge an assertion and log in as any user, including administrators.

From there, SAP's own assessment is that a full compromise could follow, possibly reaching connected systems. In a landscape where the SAP system talks to finance, logistics, manufacturing and payroll, a forged administrator session is not a web application problem. It is the keys to the business.

RedRays, which reviewed the notes on patch day, advises treating every AS ABAP system that uses SAML2 for browser logon as in scope until shown otherwise, reviewing all trusted identity providers in transaction SAML2, and checking audit logs for SAML logons by privileged users from unexpected sources. There is no workaround, so the correction instructions or the listed support package is the only fix. Of the four, this is the flaw where SAP security detection work matters as much as patching, because a forged logon is visible in the logs if anyone looks.

A related SAML flaw in the same component, CVE-2026-44748, was fixed in June and required the attacker to hold a normal user account first. The November flaw removed even that requirement, which is why the CVSS score moved to the maximum. SAP security documentation for the June fix is worth reading alongside this one, because the two together show how the same component was weakened twice in five months.

The patching trap: out-of-maintenance kernels

The version lists in the bulletin are not the whole story, and this is where many estates will discover a problem they did not know they had.

Onapsis states that kernels outside SAP's maintenance window are affected too. For the ICM and Web Dispatcher flaws, its advisories list kernels 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89. The Gateway flaw reaches the same kernels plus 7.20 and 7.21. Those releases may not receive a fix at all, which turns a patching exercise into an upgrade project for any estate still running them.

That is not a hypothetical population. Large estates routinely keep old kernel levels alive for years because an upgrade touches every system at once. The November bulletin is the argument for funding that upgrade, because an unpatchable CVSS 10.0 in internet-facing components is a finding waiting for an audit, or worse, for an attacker. SAP security budgets that have deferred kernel upgrades for years rarely have a better argument than this bulletin to reopen the case.

What SAP security teams should do this week

The guidance from RedRays and Onapsis converges on an order of operations, and the sequence matters because some fixes are partial. It is also the sequence SAP security teams should communicate to application owners now, before the change windows are negotiated.

1. Inventory first. Find every Web Dispatcher, every Gateway, and every AS ABAP system using SAML2 for browser logon. A missed instance leaves the flaw open. Web Dispatchers in HANA XS Classic and XS Advanced are easy to overlook, and asset inventories that only track application servers tend to miss them entirely, which is why the first SAP security action this week is a discovery exercise rather than a patch.
2. Patch the Web Dispatcher tier as the priority, since it faces the internet. RedRays advises updating the kernel and all Web Dispatchers in a single rollout covering all 17 kernel and Web Dispatcher fixes this month.
3. For the Gateway, patch and then verify the proxy list. A restrictive prxyinfo or gw/acl_mode_proxy set to 1 is part of the fix, not an optional extra. Limiting gateway ports 33NN and 48NN to hosts that genuinely need RFC access reduces exposure while the patch rolls out.
4. For the ICM, the fix ships through dw.sar and the SP Stack Kernel. Where users reach the ICM only through a Web Dispatcher, patching that Web Dispatcher shields the ICM temporarily. The shield fails on a Web Dispatcher configured as a router, and it holds only while nobody can reach ICM ports directly.
5. For SAML2, there is no workaround. Patch, then review trusted identity providers and audit logs for privileged SAML logons from unexpected sources.
6. Where a kernel cannot be patched, restrict network access as a stopgap and schedule the upgrade. Disabling WebSocket support blocks the memory corruption bugs, but it breaks ABAP Push Channels and some Fiori features, so treat it as a last resort with a clock on it.

One caution on patch levels comes from Onapsis: on release 7.93, patch level 419 of the ICM component remains vulnerable even though it is a higher number than 401, and only the updated 401 Stack Kernel, 402 once released, and 420 or later carry the fix. Verify the exact level rather than assuming newer is safer. That single detail will trip up more than one SAP security team this month, because patch level numbers usually behave the intuitive way.

What the rest of the November bulletin says

The four maximum-score notes do not end the list, and SAP security teams with limited patch windows should know what sits directly beneath them.

Three notes carry CVSS 9.9. One is a code injection in SAP NetWeaver Knowledge Management XML Forms, fixed in Note 3809153. Another is an OS command injection in the ABAP Application Server for SAP NetWeaver and ABAP Platform, fixed in Note 3792735, which is as close to the four 10.0s as a rating can get. The third is a missing authorisation check in S4CRM, fixed in Note 3834842.

A 9.6 rated cross-site request forgery affects the Web Dispatcher and ICM together, fixed in Note 3804858, meaning the two components already carrying the worst bugs picked up another web-facing issue in the same month. A 9.1 rated XXE flaw in SAP BusinessObjects Web Intelligence rounds out the critical tier.

In total the month brought 35 new security notes, 4 GitHub security advisories covering the SAP Cloud SDK libraries, and 3 updates to previously released notes. The SAP security calendar does not usually put four 10.0s and three 9.9s in the same bulletin, and estates that patch only the headline items will leave a 9.9 OS command injection unaddressed.

Why four 10.0s in one month matters for SAP security

The severity scores are only part of the story. What distinguishes this bulletin is that all four flaws need no credentials and no user interaction, on components that sit at the perimeter or the core of an SAP landscape. SAP security has spent two decades defending authentication-heavy systems, and pre-auth exploits change the threat model.

The rest of the month's list shows the pattern continuing beneath the headline. A 9.9 rated code injection in NetWeaver Knowledge Management, a 9.9 rated OS command injection in the ABAP Application Server, and a 9.9 rated missing authorisation check in S4CRM all shipped alongside the four top-rated notes. SAP security work this month is not a single emergency, it is a tier of emergencies with a long tail under it.

For context on how the industry treats this class of bug, the Linux kernel SMB server had two 9.0 rated flaws sit unpatched for months this autumn. The Unsloth Studio remote code finding showed how quickly unauthenticated code execution draws a response when it surfaces in a popular tool. SAP's difference is scale: these components run the finance and logistics systems of a large share of the Fortune 500, and security review processes elsewhere in the industry are still catching up to the same lesson. Pre-auth bugs in core infrastructure are the ones that end up exploited. The SAP security community has known this pattern since the RECON vulnerabilities in 2020, and this bulletin shows the pattern is not going away.

No exploitation has been reported for any of the four as of publication. The researchers shared working exploits with the vendor responsibly, which means working exploits now exist outside SAP. The gap between a private exploit and a public one is historically short, and it is the reason this bulletin reads as a countdown rather than a checklist. SAP security work this month is a race against that gap.

Questions readers are asking

Are these flaws being exploited?

Not as of publication. Neither Onapsis nor SAP reports any observed exploitation. Both ICM2SHELL and PROXYGATE were demonstrated in proof of concept, so the capability exists, and unauthenticated remote code execution in internet-facing components is exactly the class that gets weaponised quickly. SAP security teams should assume the private exploits will not stay private.

Which systems need patching?

Every system running one of the affected components: SAP NetWeaver AS ABAP with the ICM, any standalone or embedded Web Dispatcher, any system running a SAP Gateway including AS Java and standalone gateways, and AS ABAP systems using SAML2 for browser logon. The affected version lists in the bulletin are long, and kernels outside maintenance are affected too.

Is there a workaround if I cannot patch immediately?

Partial ones. Disabling WebSocket support blocks the memory corruption bugs but breaks ABAP Push Channels and some Fiori features. A restrictive prxyinfo reduces Gateway exposure without removing it. Patching a Web Dispatcher shields a protected ICM only while nobody can reach ICM ports directly and the dispatcher is not in router mode. The SAML2 flaw has no workaround at all.

How urgent is this compared with a normal Patch Day?

Significantly more urgent. A typical SAP Patch Day spreads critical fixes across products, and most need some form of access. Four unauthenticated CVSS 10.0 flaws in the core stack, with working private exploits, puts this month in the category where SAP security teams compress their normal patch cycle and communicate deadlines to application owners rather than waiting for change windows.

The bottom line

Four CVSS 10.0 flaws needing no login, in the components that face the internet and the components that run the business, is the worst combination SAP security teams can draw in a single bulletin. Two end in remote code execution as the installation account. One ends in a forged administrator session. One turns a hardened Gateway into an open door through a list most administrators have never reviewed. The SAP security workload this month is the sequence above, taken in order, and the clock started on 10 November.

The good news is that fixes exist, the researchers worked responsibly, and no exploitation has been seen. That state of affairs lasts exactly as long as it takes someone to weaponise a public advisory. The patching sequence above takes effort, and the out-of-maintenance kernels in the affected lists turn part of it into an upgrade project, but the alternative is leaving pre-auth code execution in place on the systems that run the business.

[fluentform id="2"]