SAP has fixed a maximum-severity flaw in SAP Gateway, tracked as CVE-2026-89103 and named PROXYGATE, that lets an unauthenticated attacker run operating system commands on an SAP system. The fix arrived on SAP Security Patch Day on 10 November 2026, and SAP rates the flaw 10.0, the highest possible CVSS score.

The vulnerability was discovered and reported by the Onapsis Research Labs, which worked with SAP under coordinated disclosure. SAP issued Security Note 3798345 to fix it, together with FAQ Note 3810197. BleepingComputer reports that SAP patched 35 vulnerabilities in its November 2026 security updates, including four rated at the maximum severity.

What PROXYGATE is and how it works

PROXYGATE is a pre-authentication remote code execution vulnerability in the SAP Gateway, the component that handles remote function calls, registers external programs and can start helper programs on the host. An unauthenticated attacker with network access to the gateway can run operating system commands as <sid>adm, the account that owns the SAP installation, with no credentials and no user interaction.

The flaw turns on the gateway's proxy access control list, known as prxyinfo, rather than the secinfo and reginfo lists that most SAP hardening guidance focuses on. According to Onapsis, a specially crafted series of requests in the gateway's CPI-C layer can make the gateway believe an outside attacker's request comes from one of the system's own internal application servers. Once the gateway accepts that conclusion, its access-control lists behave exactly as configured for an internal server, and the attacker can ask it to start an arbitrary operating system command.

Whether a system can be exploited depends on its proxy configuration. A gateway with a restrictive prxyinfo file is not exploitable from untrusted networks. But Onapsis warns that several other configurations leave the proxy policy open, and some of them are defaults. When no prxyinfo file exists at all, the outcome depends on the profile parameter gw/acl_mode_proxy, which ships disabled for backward compatibility, meaning allow-all.

Which systems are affected

Because the flaw is in the SAP kernel rather than in one application release, it affects a broad range of systems that run an SAP Gateway. That includes SAP NetWeaver ABAP-based systems such as SAP S/4HANA, SAP ERP/ECC, SAP BW and SAP Solution Manager, as well as AS Java and dual-stack systems and standalone gateway installations.

Kernel versions already out of maintenance are also affected, including 7.20, 7.21, 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89. Onapsis says those systems must be upgraded to a downward-compatible kernel that is still in maintenance. A hardened secinfo and reginfo configuration does not take a system out of scope, and neither do SAP authorisations or the application stack running above the gateway.

How to fix it

Full remediation has two parts. First, apply the kernel patch in SAP Security Note 3798345 where required. Second, set the profile parameter gw/acl_mode_proxy to 1, or maintain a restrictive prxyinfo file. Kernels 7.93 and 9.16 already support the parameter, so the fix there is to set it to 1 with no new kernel required. Kernels 7.22, 7.53, 7.54, 7.77 and 8.04 gain support for it with the kernel patch, and kernels 9.20 and 9.21 also receive a patch.

Onapsis says a restrictive prxyinfo file should be put in place first on any system where one is permissive, starting with gateways reachable from the internet, and that the patch, the parameter and the prxyinfo changes should be applied on every application server, not only the primary instance. Network access to the gateway ports should also be narrowed to the hosts that genuinely need it. SAP lists no official workaround, although a restrictive prxyinfo file reduces exposure until a system can be patched.

Why the flaw matters

The <sid>adm account owns the SAP installation, its executables, instance profiles, secure store and database connection. Running commands as that user is, in practice, full control of the SAP system. Onapsis says an attacker could recover database credentials and other secrets, collect RFC destinations and technical credentials to move laterally, change configuration or binaries to keep access, or stop the system and destroy data.

For an ERP system, that means direct exposure of financial, human resources, supply chain and customer data, the integrity of the transactions built on it, and the availability of business-critical systems. PROXYGATE is one of four flaws SAP rated 10.0 in this release, alongside CVE-2026-76964 in the Internet Communication Manager, CVE-2026-89126 in SAP Web Dispatcher and CVE-2026-120017 in the SAML2 service provider. As of publication, Onapsis said it had not observed active in-the-wild exploitation of PROXYGATE, and it continues to monitor for signs of attacks.