SAP Issues Patches for Four CVSS 10.0 Vulnerabilities
SAP Patches Four Critical Flaws with Maximum 10.0 CVSS Score
CVE Identifiers
Full Report
Executive Summary
SAP has released its November 2026 Security Patch Day updates, addressing 35 new vulnerabilities. Among them are four critical flaws that have each received the maximum possible CVSS score of 10.0. These vulnerabilities, if exploited, could allow an unauthenticated, remote attacker to completely compromise affected SAP systems. The security firm Onapsis is credited with discovering three of the four flaws. Given the criticality of these issues and the history of rapid exploitation of SAP vulnerabilities, organizations are strongly advised to prioritize the application of these patches to protect their mission-critical business systems.
Vulnerability Details
The four maximum-severity vulnerabilities pose a significant risk to organizations running SAP software. They allow for remote, unauthenticated attacks.
- ICM2SHELL: This name covers two distinct vulnerabilities:
- CVE-2026-76964: A vulnerability in the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP.
- CVE-2026-89126: A vulnerability in the SAP Web Dispatcher.
- PROXYGATE (CVE-2026-89103): A broken access control vulnerability in the SAP Gateway.
- CVE-2026-120017: A missing authentication check vulnerability in the SAML2 Service Provider component of NetWeaver AS ABAP and ABAP Platform.
Exploitation of these vulnerabilities could lead to a full system takeover, allowing an attacker to steal sensitive business data, disrupt operations, or use the compromised SAP system as a pivot point for further attacks within the corporate network.
Affected Systems
The vulnerabilities impact some of SAP's most widely deployed products, which form the core of many large enterprises:
- SAP NetWeaver Application Server (AS) ABAP
- SAP ABAP Platform
- SAP Web Dispatcher
- SAP Gateway
Organizations must review the specific SAP Security Notes corresponding to each CVE to identify the exact product versions and patch levels required.
Exploitation Status
According to Onapsis, there is no evidence that these specific vulnerabilities are being exploited in the wild at this time. However, the security firm has successfully developed a working proof-of-concept exploit for ICM2SHELL, confirming the viability of an attack. Threat actors specializing in SAP are known to reverse-engineer patches quickly to develop exploits. Therefore, the window of opportunity for defenders to patch is likely to be very short.
The existence of a working PoC for CVSS 10.0 vulnerabilities means that exploitation is not a matter of 'if' but 'when'. Patching should be considered an emergency-level priority.
Cyber Observables — Hunting Hints
The following patterns can help identify vulnerable systems or exploitation attempts:
/sap/public/icmanSAP ICM Access Logs (icm_access_log)disp+work.exe (Windows), dw.sap (Linux)Detection Methods
- Vulnerability Scanning: Use a vulnerability scanner with up-to-date plugins for SAP to identify all affected systems in the environment. Prioritize internet-facing systems like SAP Web Dispatcher and SAP Gateway.
- Log Analysis: Ingest SAP logs (e.g., ICM, Gateway, Security Audit Log) into a SIEM. Create rules to detect anomalies, such as successful logins from external IPs, execution of sensitive function modules, or changes to critical configurations. This is a form of D3FEND's
Platform-based Analysis. - Network Traffic Analysis: Monitor traffic to and from SAP systems. Look for probes against common SAP ports or unusual payloads that could indicate an exploitation attempt. This aligns with D3FEND's
Network Traffic Analysis(D3-NTA).
Remediation Steps
- Apply SAP Security Notes: The primary remediation is to apply the security patches released by SAP on November's Patch Day. Organizations should identify all vulnerable systems and deploy the relevant notes as quickly as possible.
- Restrict Network Access: Review network firewall and access control lists. Ensure that SAP systems, particularly the application servers, are not directly exposed to the internet. Access should be restricted to trusted internal networks and authorized users.
- Virtual Patching: If immediate patching is not feasible, use an Intrusion Prevention System (IPS) or a Web Application Firewall (WAF) to implement virtual patches that can block known exploitation patterns. This should be considered a temporary compensating control, not a substitute for patching.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Applying the SAP security notes is the most critical and effective mitigation.
Strictly control network access to SAP systems. Internet-facing components like the Web Dispatcher should have hardened firewall rules.
D3FEND Defensive Countermeasures
The only effective long-term defense against these CVSS 10.0 vulnerabilities is to apply the patches provided by SAP. Due to the high risk of rapid weaponization, organizations must treat this as an emergency change. SAP Basis teams should immediately begin planning and testing the deployment of the November Security Notes, prioritizing internet-facing systems like SAP Web Dispatcher and SAP Gateway. Use a vulnerability management solution to confirm that all relevant systems have been identified and that the patches have been successfully applied. Given the criticality, the goal should be to achieve full remediation within 72 hours.
As a compensating control and defense-in-depth measure, organizations must enforce strict inbound traffic filtering for all SAP systems. No SAP application server (NetWeaver AS) should be directly accessible from the internet. All traffic should be routed through a reverse proxy like the SAP Web Dispatcher. At the network perimeter, firewall rules must be configured to only allow access to the Web Dispatcher from specific, trusted IP ranges on the required HTTP/S ports. All other ports, including the SAP message server and internal RFC ports, must be blocked from external access. This network hardening can help prevent an attacker from reaching a vulnerable, unpatched service.
Timeline of Events
SAP releases its November Security Patch Day, including fixes for four CVSS 10.0 vulnerabilities.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.