Recent revelations have highlighted significant vulnerabilities within SAP systems, potentially allowing unauthorized users to gain control without proper authentication. These flaws, known as PROXYGATE and ICM2SHELL, were addressed by SAP’s latest security updates released on November 10, 2026.
Details of the Vulnerabilities
The vulnerabilities, which have been assigned the highest CVSS severity score of 10.0, impact core SAP components widely utilized in business applications. They were discovered and reported by Onapsis Research Labs, necessitating urgent action from organizations using affected systems.
These security flaws enable attackers with network access to execute operating system commands under the ‘adm’ account, responsible for the SAP installation. This level of access, while not granting root server control, poses significant risks to business data, stored credentials, and application functionality.
Understanding PROXYGATE
Identified as CVE-2026-89103, PROXYGATE affects the SAP Gateway component, which facilitates communication between SAP systems and external applications. Unlike vulnerabilities stemming from weak gateway rules, this kernel-level weakness persists even with typical access control lists.
The flaw arises from how the gateway assesses whether a request originates from a trusted source. If the proxy policy inadvertently permits the connection, attackers can craft requests to appear as though they are from internal servers, thus bypassing security checks.
This vulnerability’s exploitation depends heavily on the prxyinfo proxy access list settings. Properly configured restrictive policies can prevent unauthorized access, whereas permissive settings might leave systems vulnerable.
Impacts of ICM2SHELL
ICM2SHELL, covered under CVE-2026-76964 and CVE-2026-89126, presents another critical security challenge. It involves memory corruption within shared SAP kernel code, affecting the Internet Communication Manager and SAP Web Dispatcher components.
Exploitation of this flaw could allow unauthorized parties to corrupt process memory, execute arbitrary commands, or disrupt service. This is particularly concerning as WebSocket support, which is often enabled by default, requires no user interaction for exploitation.
While no active exploitation of these vulnerabilities has been reported, the potential impact underscores the necessity for comprehensive security measures. Historical SAP attacks, such as the NetWeaver breach, illustrate the significant business risks involved.
Mitigation and Future Outlook
Organizations are urged to apply the latest patches and implement configuration changes to mitigate these vulnerabilities. PROXYGATE requires not only updates but also the adjustment of gw/acl_mode_proxy settings, alongside stricter prxyinfo rules.
For ICM2SHELL, SAP has issued Security Notes 3778530 and 3778556, advising immediate attention to exposed Web Dispatcher and ICM services. Ensuring network restrictions and comprehensive patch application across SAP environments are essential steps in maintaining security.
Overall, these vulnerabilities highlight the ongoing need for robust cybersecurity practices within enterprise environments. Proactive measures, alongside vigilant monitoring and timely updates, are critical in safeguarding against potential threats.
