:quality(90)/p7i.vogel.de/wcms/f1/5d/f15d0d83fb9a118ac07d23dd988ce358/0134476561v2.jpeg)
Three CVSS 10.0 vulnerabilities hit enterprise software on Nov. 11, 2026, forcing a rush to patch systems.
High Patch Volume
The November patch day from SAP brought 35 new security notes, four GitHub advisories, and three updates.
HotNews and high-priority notes totaled 25.
According to Onapsis, SAP published 43 new and updated security advisories for the November Security Patch Day overall, including twelve HotNews advisories and 13 rated high priority. The security-focused provider Onapsis analyzes the vulnerabilities SAP fixes each month and issues its own recommendations. Given the rising patch volume, it advised companies to assess all vulnerabilities and continuously monitor the exposure management of their critical SAP systems.
The Exploit Prediction Scoring System, or EPSS, indicates the probability in percent that a vulnerability will be exploited within the next 30 days. The ICM and Web Dispatcher flaws each carry an EPSS score of 0.43, while the Gateway flaw stands at 0.32.
Internet Communication Manager Flaw
A memory corruption bug in the SAP Internet Communication Manager allows unauthenticated attackers to execute operating system commands. All About SECURITY reported that the vulnerability carries a CVSS score of 10.0 and the identifier CVE-2026-76964.
The flaw stems from how the kernel handles WebSocket traffic. Components process incoming packets beyond reserved memory boundaries.
Processes can crash or run commands with the privileges of the system user. Thousands of public-facing systems remain exposed according to estimates.
The Onapsis Research Labs, which discovered the flaw dubbed ICM2SHELL, estimates that thousands of SAP systems with ICM-based HTTP interfaces may be reachable over the public internet. SAP addressed it in security notes 3778530 for the ICM and 3778556 for the Web Dispatcher, including the version embedded in SAP HANA XS, along with FAQ note 3778788. Both notes received a CVSS score of 10.0.
Where services accept WebSocket connections without authentication, neither credentials nor user interaction are required, according to Onapsis. Whether unauthenticated exploitation is possible depends on the kernel version in use.
An attacker could, among other things, read database credentials and view or alter business data, collect RFC destinations and technical logins to reach connected systems, modify configurations or binaries for persistent access, or shut the system down and destroy data. Even without code execution, a single connection can crash the ICM or Web Dispatcher, leaving Fiori apps, web services and APIs unreachable.
The fix is contained in the updated PL-401 stack kernel, in PL 402 after its release, and in PL 420 and higher. Only applying notes 3778530 and 3778556 fully closes the gap. Operators in the SAP Private Cloud, such as those using RISE with SAP, should also heed note 3849055.
Onapsis recommends first taking inventory of systems by kernel version and patch level, including standalone Web Dispatchers, HANA XS instances, non-production systems holding production data and legacy systems, then patching internet-facing components first. Disabling WebSocket support via icm/HTTP/support_websocket_upgrade=FALSE and a restart also removes the flaw.
Gateway Request Handlers
Another maximum-severity flaw dubbed PROXYGATE targets the SAP Gateway component. Börse Express berichtete, dass die Schwachstelle im SAP Gateway unter der Kennung CVE-2026-89103 geführt wird.
Attackers send specially crafted data packets to trick the gateway. The system believes requests originate from an internal host.
Access control lists approve the traffic without user credentials.
Hardened access control lists “secinfo” and “reginfo” do not stop the attack; what matters instead is the less-noticed proxy access control list “prxyinfo”, which remains open in several standard configurations, according to Onapsis.
Four Maximum-Severity Fixes
According to SAP’s security bulletin, the four maximum-severity vulnerabilities correspond to security notes 3778530, 3778556, 3798345 and 3849308, in that order. Two of them could allow unauthenticated attackers remote code execution on vulnerable systems. The fourth, CVE-2026-120017, affects the SAML 2.0 service provider for single sign-on in SAP NetWeaver AS ABAP and ABAP Platform, where missing authentication checks could let attackers impersonate users, including those with privileged accounts.
SAP also fixed five further vulnerabilities rated critical. Administrators who cannot patch immediately are advised to review network-accessible interfaces of the Web Dispatcher and Internet Communication Manager, especially those reachable without authentication, check authentication and access controls, confirm corrected versions are running and review relevant logs for suspicious activity.
SAP's Four CVSS 10.0 Bugs and Hardening Gaps
How many maximum severity bugs did SAP patch?
SAP resolved four vulnerabilities rated with a CVSS score of 10.0 during the November patch day. These covered NetWeaver, Web Dispatcher, SAML2, and the Gateway.
What permissions do attackers gain through ICM2SHELL?
Attackers can run operating system commands with the rights of the system user. This access requires no prior authentication or user interaction.
Does hardening stop the PROXYGATE exploit?
Standard hardened configuration lists like secinfo and reginfo do not prevent the attack.
