Overview
SAP has released its November 2026 security updates, fixing 35 vulnerabilities, including four maximum-severity vulnerabilities rated CVSS 10.0. The most significant issues affect SAP NetWeaver, SAP Gateway and SAP Web Dispatcher, with unauthenticated remote attackers potentially able to compromise exposed systems without requiring an SAP account, password or user interaction.
ICM2SHELL and PROXYGATE
Security researchers at Onapsis have named two of the attack techniques ICM2SHELL and PROXYGATE. ICM2SHELL involves memory-corruption vulnerabilities in NetWeaver’s Internet Communication Manager and SAP Web Dispatcher, potentially turning components responsible for handling web traffic into an entry point for remote code execution. PROXYGATE targets SAP Gateway through a broken access-control weakness that can allow an unauthenticated attacker to impersonate an internal application server and obtain control of the SAP environment.
Why It Matters
These vulnerabilities are particularly serious because SAP systems often sit at the centre of an organisation’s ERP, financial, supply-chain, HR and business operations. A successful compromise could therefore extend well beyond the affected server, potentially exposing sensitive business data, allowing transactions to be manipulated and disrupting critical applications. The fact that exploitation does not require an SAP user or authentication significantly increases the risk for externally accessible systems.
Security Best Practices
SAP administrators should prioritise the November security updates, particularly for Internet-facing NetWeaver, Gateway and Web Dispatcher deployments. Where immediate patching is not possible, organisations should review external exposure, restrict access to SAP management and application interfaces, monitor authentication and application-server communication for anomalies, and follow SAP and Onapsis remediation guidance. Patching should also be followed by validation that no unexpected processes, accounts, configuration changes or other indicators of compromise remain on the system.
Broader SAP Risk
This is not an isolated SAP security concern. SAP has patched multiple maximum-severity vulnerabilities during 2026, including issues affecting Commerce Cloud, the SAP Kernel and BTP applications, while CISA has identified 14 SAP vulnerabilities as actively exploited since 2021. Organisations should therefore treat SAP vulnerability management as part of their core security programme rather than relying solely on normal monthly server patching.
Expert in the Cloud Insight
SAP security is business security. These vulnerabilities demonstrate why an ERP platform cannot be treated like an ordinary application server: compromising the underlying platform can potentially give an attacker access to the systems and information that run the business. Organisations should maintain a clear inventory of SAP components, identify which systems are Internet-facing, apply critical security notes rapidly and continuously monitor the environment for signs of compromise. For enterprise SAP environments, a CVSS 10 vulnerability should be treated as an operational priority, not simply another item on the patching list.
Expert in the Cloud – The Future Is Now.
Leave a Reply