SAP released 43 new and updated security notes this month, including 12 HotNews. Onapsis Research Labs contributed to 24 of them, among them two vulnerabilities rated CVSS 10.0.
SAP’s security patch day in November is far larger than usual. According to security specialist Onapsis, SAP released a record 43 new and updated security notes, including 12 HotNews and 13 High Priority notes. Two of the flaws, ICM2SHELL and PROXYGATE, carry the maximum CVSS score of 10.0 and allow remote attackers to run operating system commands on an SAP host without logging in.
Onapsis Research Labs contributed heavily to the release. According to the company, 24 of the security notes go back to its reports and address 36 vulnerabilities in total; 14 of these were discovered together with XBOW and reported to SAP. Seven of the 12 HotNews notes and ten of the 13 High Priority notes were reported with the lab’s involvement. Onapsis puts the combined 25 HotNews and High Priority notes well above the usual monthly average and advises organizations to assess every vulnerability and to keep a continuous eye on the exposure of their critical SAP landscapes.
ICM2SHELL (CVE-2026-76964 and CVE-2026-89126) concerns the way the SAP Internet Communication Manager (ICM) processes WebSocket traffic. The same code is used by the SAP Web Dispatcher, so both components are affected. Successful exploitation lets an unauthenticated attacker execute operating system commands with the privileges of the SAP administrator user (<sid>adm) and take over the system completely. Attackers could also crash the ICM or Web Dispatcher and interrupt the web services behind them. Where services accept WebSocket connections without authentication, neither credentials nor user interaction are required; whether unauthenticated exploitation is possible depends on the kernel version. Onapsis Research Labs estimate that thousands of SAP systems with ICM-based HTTP interfaces could be reachable from the public internet. Disabling WebSocket support is a possible workaround, but Onapsis advises against it because of the impact on interactive and integration scenarios.
PROXYGATE (CVE-2026-89103) targets the SAP Gateway. With a specially crafted sequence of data packets, an external attacker can make the gateway believe that it belongs to an internal host of the SAP system. The gateway’s access control lists then approve the request, and operating system commands run with <sid>adm privileges. According to Onapsis, even hardened secinfo and reginfo lists do not stop the attack. The decisive factor is the less-noticed proxy access control list prxyinfo, which stays open in several default configurations. The flaw also allows lateral movement to all other application servers of the affected system. After installing the patch, customers must additionally set a profile parameter manually, Onapsis notes.
In its full analysis, Onapsis counts four notes with a CVSS score of 10.0 in total. Besides the ICM, Web Dispatcher and Gateway notes, this includes a missing authentication check in the SAML2 service provider of SAP NetWeaver AS ABAP, which could allow unauthenticated attackers to impersonate arbitrary users.
Beyond the two headline flaws, the HotNews list contains several further critical entries. Four notes are rated CVSS 9.9, among them a missing authorization check in S4CRM, an operating system command injection in the ABAP application server and a code injection flaw in SAP NetWeaver Knowledge Management (XML Forms) that Onapsis found together with XBOW. Two HotNews notes affect the SAP Business AI Platform: a memory corruption flaw in the Node.js Brotli decoder and the so-called php2shell chain, two remote code execution vulnerabilities in PHP that can be combined in one attack; both are rated CVSS 9.8. Further notes address cross-site request forgery in the Web Dispatcher and ICM (CVSS 9.6) and an XML external entity flaw in SAP BusinessObjects (CVSS 9.1).
The High Priority notes are dominated by memory corruption and denial-of-service flaws in components such as the Message Server, the Internet Graphics Service and the Web Dispatcher, several of which can crash processes without authentication. One note fixes a missing authentication check in the SAP NetWeaver AS Java EDM application by removing the application from customers’ systems during SUM updates; SAP has also withdrawn it from SAP Marketplace. Eight further notes of lower severity, including cross-site scripting and server-side request forgery, round out the lab’s contribution.
As far as Onapsis currently knows, there is no evidence of active exploitation. Onapsis and SAP nevertheless recommend installing the available patches without delay. The company says it is already updating its platform to cover the newly published vulnerabilities. According to the company, customers of its Onapsis Defend solution were protected against exploitation of the vulnerabilities before the patches were published.
For SAP teams, the volume means a demanding week, and the two maximum-rated flaws are the obvious starting point, since both allow unauthenticated command execution. Onapsis Research Labs discuss the vulnerabilities today, November 12, at 4 p.m. CET (10 a.m. EST) in a threat briefing titled “Navigating November’s Historic SAP Security Patch Day”.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de
For certain setups, those high scores might not reflect actual exposure. Tender Crane