SAP has patched four vulnerabilities rated at the maximum CVSS score of 10.0 as part of its November 2026 Security Patch Day, warning customers to treat the fixes as a priority. The flaws, disclosed on 10 November 2026, affect SAP NetWeaver, SAP Web Dispatcher, SAP Gateway and the SAP ABAP platform, and three of them can be exploited by an attacker without logging in or any action from a user.

The November release contains 43 new and updated security notes in total, and four of them carry the top severity rating. That is an unusually heavy Patch Day even by SAP’s standards, and it puts the spotlight on the internet-facing components that sit in front of many large organisations’ core business systems.

What the four CVSS 10.0 flaws are

The first two flaws are closely related. CVE-2026-76964 is a memory corruption vulnerability in the Internet Communication Manager (ICM) of SAP NetWeaver Application Server ABAP, fixed in SAP Security Note 3778530. CVE-2026-89126 is a heap-based buffer overflow in SAP Web Dispatcher, fixed in Note 3778556. Researchers at Onapsis, who found both flaws, call them ICM2SHELL because they come from a single weakness in kernel code that the two components share.

The third flaw, CVE-2026-89103, is a broken access control weakness in SAP Gateway, fixed in Note 3798345. Onapsis calls it PROXYGATE. The fourth, CVE-2026-120017, is a missing authentication flaw in the SAML 2.0 service provider of the ABAP platform, fixed in Note 3849308. It could allow an attacker to bypass authentication checks that rely on SAML assertions.

All four flaws carry the same CVSS 3.1 vector, with network access, low attack complexity, no privileges required and no user interaction. SAP rates each of them 10.0, the highest possible score.

How ICM2SHELL could lead to remote code execution

The ICM and Web Dispatcher handle incoming HTTP, HTTPS and WebSocket traffic for SAP systems. According to Onapsis, the shared kernel code that reassembles split WebSocket messages does not validate the fragments properly, and a crafted message can corrupt heap memory. An attacker who can reach the software over the network could use that corruption to run operating system commands as the SAP installation owner account, known as <sid>adm, without credentials.

That matters because the affected components are often exposed to the internet. Web Dispatcher in particular is commonly placed in front of SAP systems as a reverse proxy, so a flaw in it can be reached by anyone on the network. Onapsis also notes that WebSocket support is enabled by default on the affected kernels, so systems are exposed even if no application actually uses WebSocket features.

The affected kernel versions include 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20. Onapsis has said that kernels which are out of maintenance are affected too, which means some older installations will need a kernel upgrade rather than a routine patch.

PROXYGATE needs more than a patch alone

The Gateway flaw is different in character but no less serious. SAP Gateway connects an SAP server to other SAP systems and programs, and it keeps a list of trusted application servers in a proxy list. CVE-2026-89103 means the gateway can enable its default proxy list with high privileges, so an external attacker can be treated as one of the system’s own application servers and take unauthorised actions, including running operating system commands.

Onapsis has warned that fixing this flaw is not only a matter of applying the kernel patch. On most kernel releases the fix also depends on a profile parameter that ships switched off, so administrators must check the setting and switch it on, and must check the gateway’s proxy list itself. A version check alone will not tell an organisation whether it is safe.

What administrators should do now

SAP strongly recommends applying the four notes as a priority. Internet-facing Web Dispatcher systems should come first, followed by the ICM on NetWeaver application servers, SAP Gateway installations and the ABAP platform’s SAML service provider. Organisations should also review which of their systems are reachable from the internet, since that determines how exposed each flaw is in practice.

There is some reassurance in the timing. As of the researchers’ publications on 10 November, no exploitation of these four flaws had been observed, and the CVE numbers did not appear in CISA’s Known Exploited Vulnerabilities catalogue. That does not mean the flaws are safe to leave unpatched: maximum-severity flaws in widely used enterprise software attract attention quickly once the details are public, and the patches are already available.

SAP publishes security notes on the second Tuesday of each month. The November release is a reminder that the company’s core communications components, not just its business applications, need the same patching discipline as any other internet-facing system. Sources: The Hacker News and Windows Forum.