SAP Patches ICM2SHELL and PROXYGATE Maximum‑Severity Flaws
What Happened — SAP released its November 2026 security update, fixing 35 vulnerabilities, including four rated 10/10 CVSS. The most critical are:
- CVE‑2026‑76964 – memory‑corruption in NetWeaver ICM (ICM2SHELL).
- CVE‑2026‑120017 – missing authentication in NetWeaver SAML2 Service Provider.
- CVE‑2026‑89103 – broken access‑control in SAP Gateway (PROXYGATE).
- CVE‑2026‑89126 – memory‑corruption in SAP Web Dispatcher.
Both ICM2SHELL and PROXYGATE allow an unauthenticated attacker to execute code on the exposed component without any user interaction, potentially giving full control of the ERP system, its data, and transaction integrity. The flaws affect core SAP NetWeaver, Gateway, and Web Dispatcher components that are present in virtually every enterprise SAP deployment.
Why It Matters for Trust & Control Assurance — The incident underscores the need for a robust vulnerability‑management control that ensures timely patching of critical components, a control that satisfies multiple frameworks simultaneously.
Who Is Affected — Large enterprises using SAP ERP/NetWeaver, SAP Gateway, or SAP Web Dispatcher across any industry (manufacturing, finance, retail, etc.).
Recommended Actions
- Verify that the November 2026 SAP patches are applied to all NetWeaver, Gateway, and Web Dispatcher instances.
- Review your vulnerability‑management process: ensure critical CVEs are prioritized, patched within defined SLAs, and documented as evidence.
- Conduct a post‑patch validation scan to confirm the flaws are remediated.
Source: BleepingComputer
Technical Notes
- Attack vectors: remote code execution via unauthenticated network traffic (ICM2SHELL) and forged internal‑server requests (PROXYGATE).
- CVSS 10.0 for all four CVEs.
- No public evidence of active exploitation yet, but the severity warrants immediate remediation.