Critical Vulnerabilities in SAP NetWeaver, Web Dispatcher and Gateway (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017)
Executive Summary
On November 11th, SAP released their November 2026 Security Patch addressing 42 security fixes. This included four vulnerabilities rated CVSS 10.0 that affect core infrastructure components in the SAP NetWeaver stack. All four are exploitable by an unauthenticated attacker over the network with no user interaction required.
Two memory corruption flaws, tracked collectively as "ICM2SHELL" by Onapsis, target the Internet Communication Manager (ICM) and SAP Web Dispatcher. A third, "PROXYGATE," exploits broken access controls in SAP Gateway. A fourth bypasses SAML2 authentication through improper cryptographic signature verification. Successful exploitation of any of these could result in full system compromise.
Beazley Security recommends applying the relevant SAP Security Notes immediately. Organizations unable to patch should restrict network access to ICM, Web Dispatcher and Gateway services and review SAML2 configurations as interim mitigations.
Affected Systems or Products
Mitigations / Workarounds
- Apply SAP Security Notes 3778530, 3778556, 3798345 and 3849308 immediately. All four are kernel-level or basis-level patches and may require a system restart.
- Inventory all internet-facing SAP services.
- ICM, Web Dispatcher and Gateway are HTTP-facing by design. Identify all instances exposed to the internet or to untrusted network segments, including standalone Web Dispatcher deployments that may not be part of centralized SAP patch cycles.
- Restrict network access
- to ICM, Web Dispatcher and Gateway management interfaces to trusted internal networks if patching cannot occur immediately.
- Review SAP Gateway Access Control Lists.
- CVE-2026-89103 specifically targets the default ACL configuration. Even after patching, verify that Gateway ACLs follow least-privilege principles rather than relying on defaults.
- Audit SAML2 Service Provider configuration.
- CVE-2026-120017 affects systems using SAML2 authentication. If SAML2 is not required, consider temporarily disabling it as an interim measure. If it is required, restrict the SAML2 endpoint to known identity provider traffic.
- Monitor for anomalous authentication and access patterns
- on SAP systems, including unexpected privileged logins, Gateway requests from unfamiliar sources, and unusual ICM or Web Dispatcher behavior.
Patches
SAP published corrections for all four vulnerabilities on November 10, 2026, as part of the November Security Patch Day. Patches are available through the SAP Support Portal under the individual Security Notes listed below. Follow SAP's standard kernel update and basis upgrade procedures for your landscape.
Technical Details
While there were little details provided about the software bugs that caused the vulnerabilities, multiple reports did detail the subsystems involved. For the two most critical vulnerabilities (CVE-2026-76964 and CVE-2026-89126) are memory corruption bugs in the WebSocket component of the Internet Communication Manager (ICM). Much of the core HTTP/S traffic processed by NetWeaver is handled by the ICM, and in turn the WebSocket code. Additionally, these systems process data that can be sent without authorization on channels that are open to the Internet by default.
CVE-2026-89103 affects the RFC (Remote Function Call) subsystem of SAP Gateway. The RFC system allows for remote function calls between hosts, and uses a suite of apps to control what can be executed, and by whom. There was a flaw reported in the CPI-C layer of that system where a remote attacker could send a function call request in a way that tricked the gateway into thinking the request was coming from an internal host. Default behavior is to allow those types of requests, and while the advisory does not go into detail into what RFC functions are exposed, it does state that an arbitrary command could be run at the operating system level as the <sid>adm user.
Finally, for CVE-2026-120017, there are again no public in-depth details on the vulnerability itself, but the effect is that the SAP system failed to check cryptographic signatures on SAML2 assertions. That meant unauthenticated attackers could forge SAML responses and authenticate as any ABAP user, including privileged accounts. The specific functions that are relevant to this vulnerability are not disclosed at the time of writing.
How Beazley Security is responding
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.
Sources
Aware of an incident impacting your industry? Let us know: