SecurityWeekIonut Arghire
SAP patches critical flaws enabling unauthenticated remote code execution
Part of the CVE-2026-76964 story · since 10 Nov
- Tue 10 Nov, 03:01 UTC. SecurityOnline, first report. SAP fixes 38 flaws, including nine critical vulnerabilities.
- Tue 10 Nov, 11:00 UTC. The Hacker News, its first report on the story. SAP patches four maximum severity flaws across its systems.
- Tue 10 Nov, 15:30 UTC. SecurityWeek, its first report on the story. SAP patches critical flaws enabling unauthenticated remote code execution. This article, 3rd of 3.
On 10 November 2026 SAP published 42 new and updated security notes, including nine that address critical‑severity vulnerabilities. Four of the new notes patch maximum‑severity flaws in NetWeaver components known as ICM (Internet Communication Manager) and SAML2 Service Provider, Web Dispatcher, and Gateway.
The ICM and Web Dispatcher weaknesses, tracked as CVE-2026-76964 and CVE-2026-89126, stem from a single defect in the SAP kernel that handles HTTP, HTTPS and WebSocket traffic and relate to reassembling large WebSocket messages. Onapsis states that a specially crafted sequence of WebSocket messages can force data to bypass the memory allocated for the connection, potentially causing an immediate crash or memory corruption; it furthermore says ICM2SHELL could allow executing OS commands with <sid>adm privileges.
An exploit used in testing demonstrates full, unauthenticated remote code execution end‑to‑end as <sid>adm, with a DoS condition observed across SAP Kernel versions tested.
The campaign also patches ProxyGate, CVE-2026-89103, a max‑severity flaw in the Gateway that can be exploited by unauthenticated attackers to achieve remote code execution without user interaction by abusing open prxyinfo access controls. Onapsis notes this affects a broad range of SAP releases, including kernel versions no longer in maintenance, and that the Gateway runs on ABAP, AS Java, dual‑stack and standalone systems.
Additionally, SAP fixed a high‑severity missing authentication issue in NetWeaver (CVE-2026-120017) enabling impersonation of users under certain configurations. The bulletin’s remaining critical notes cover NetWeaver (CVE-2026-109803, CVE-2026-76965), S4CRM (CVE-2026-109795), Web Dispatcher (CVE-2026-89119) and BusinessObjects (CVE-2026-109798). Onapsis’ analysis accompanies the patch release.
How the story developed
3 articles from 3 outlets since 10 Nov. Still developing; the latest report was 34 minutes ago. This was the 3rd report, 12 hours after the first.
- Tue 10 Nov, 03:01 UTC. SecurityOnline, first report. SAP fixes 38 flaws, including nine critical vulnerabilities.
- Tue 10 Nov, 11:00 UTC. The Hacker News, its first report on the story. SAP patches four maximum severity flaws across its systems.
- Tue 10 Nov, 15:30 UTC. SecurityWeek, its first report on the story. SAP patches critical flaws enabling unauthenticated remote code execution. This article, 3rd of 3.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 3 articles as a listHide the list
- Tue 10 NovDay 03
- SAP fixes 38 flaws, including nine critical vulnerabilities03:01 · SecurityOnline · First report
- SAP patches four maximum severity flaws across its systems11:00 · The Hacker News
- SAP patches critical flaws enabling unauthenticated remote code execution15:30 · SecurityWeek · This article, 3rd of 3