SAP, a leading enterprise software provider, has recently rolled out 42 new and updated security notes. Among these, nine address vulnerabilities classified as critical. These updates are essential for organizations relying on SAP’s solutions to secure their systems.
Key Flaws in SAP Systems
Among the critical vulnerabilities, four pertain to maximum-severity issues found in SAP NetWeaver’s Internet Communication Manager (ICM) and SAML2 Service Provider, Web Dispatcher, and Gateway. Specifically, flaws tracked as CVE-2026-76964 and CVE-2026-89126 affect the SAP kernel component, responsible for handling HTTP, HTTPS, and WebSocket traffic.
The security issue, dubbed ICM2SHELL by Onapsis, involves the reassembly of fragmented WebSocket messages. When improperly handled, this flaw allows attackers to inject code or crash processes by writing outside the allocated memory space.
Potential Risks and Exploits
ICM2SHELL is not a theoretical risk. Onapsis demonstrated a working exploit enabling unauthenticated remote code execution with administrative privileges. This vulnerability affects all tested SAP Kernel releases, posing a significant threat to enterprise security.
Another critical vulnerability, known as ProxyGate (CVE-2026-89103), impacts the SAP Gateway. This flaw can be exploited by attackers mimicking internal network requests, allowing them to execute commands without authentication. This exploit’s reach extends across various SAP kernel versions, impacting ABAP, AS Java, dual-stack, and standalone-gateway systems.
Additional Security Concerns
SAP also addressed a high-severity vulnerability in NetWeaver (CVE-2026-120017), which could allow unauthorized users to impersonate others, leading to potential system breaches. Other critical notes in the update fix vulnerabilities in NetWeaver, S4CRM, Web Dispatcher, and BusinessObjects.
In total, 17 high-severity fixes tackle issues like memory corruption, denial-of-service, and information leaks. Since the previous month’s security patches, SAP has also released updates for newly discovered vulnerabilities in its Business AI Platform, including PHP2Shell and Node2Shell.
Future Outlook
These updates underscore the importance of regular patch management to safeguard enterprise systems. As cyber threats evolve, SAP continues to provide crucial security updates to mitigate risks. Organizations should prioritize implementing these patches to maintain robust security postures.
