SAP November 2026 Security Patch Day, November 10, 2026; researcher advisories from Onapsis published November 10, 2026
Four Perfect Tens, No Login Needed: SAP Patch Day Fixes ICM2SHELL, PROXYGATE and a SAML Bypass
SAP used its November Security Patch Day to fix four vulnerabilities that each carry the maximum CVSS score of 10.0, and none of them needs a login or a user to click anything. Two share one root cause that Onapsis, whose researchers found three of the four, calls ICM2SHELL: a flaw in kernel code that reassembles fragmented WebSocket messages, present in both the Internet Communication Manager (CVE-2026-76964, Note 3778530) and the Web Dispatcher (CVE-2026-89126, Note 3778556). Crafted traffic corrupts memory before authentication and can run operating system commands as the account that owns the SAP installation; WebSocket support is on by default, the researchers hold a working exploit, and out-of-maintenance kernels including 7.40 through 7.89 are affected and may never receive a fix. The third, PROXYGATE (CVE-2026-89103, Note 3798345), is a broken access control in SAP Gateway: the gateway can fall back to a default access list with high privileges, so an outside attacker is treated as one of the system internal application servers. Its trap is procedural: on most releases the kernel patch ships with a profile parameter set off, so a patched version number alone does not close it; a restrictive prxyinfo list or the parameter set correctly is part of the fix. The fourth (CVE-2026-120017, Note 3849308) is a missing signature check in the SAML2 service provider that can let an attacker sign in as any user, including privileged users, on affected configurations, with no workaround short of the correction. Onapsis reports no exploitation of any of the four so far, and none is in the KEV catalog; the month release overall carried dozens of further notes beyond these four.
Executives
SAP is the system of record for finance, payroll and supply chain in most large companies, and all four of these flaws sit in the plumbing in front of it rather than in a business transaction. Treat this as an emergency change with a business owner, not a routine monthly note: the ICM2SHELL pair has a working exploit in researcher hands, and the Gateway flaw can be patched on paper while staying open in configuration. Ask two questions in writing: which kernels and Web Dispatchers are below the fixed levels, and who verified the Gateway proxy settings after the patch, by name.
CIO / CISO
Sequence the rollout as one motion: kernel and every Web Dispatcher together, since a patched ICM behind an unpatched Dispatcher, or the reverse, leaves the shared bug reachable, and one missed Dispatcher instance reopens the estate. For the Gateway, make the configuration check a release gate: restrictive prxyinfo in place, or gw/acl_mode_proxy set to 1 where the release supports it, verified on each gateway including standalone installations. For SAML2, inventory every AS ABAP system using SAML browser sign-on, apply the correction, and review privileged SAML logons from unexpected sources. Track the out-of-maintenance kernels as a separate upgrade decision; they will not age out of this.
Engineers
Work from the notes, not the headlines: 3778530 for the ICM, 3778556 for the Web Dispatcher, 3798345 for the Gateway, 3849308 for SAML2. Mind the version trap the coverage flags on kernel 7.93, where patch level 419 is still vulnerable and the fix rides the updated stack kernels and level 420 or later. Patch standalone Dispatchers with SAPWEBDISP.SAR and embedded ones through dw.sar or the stack kernel, and remember HANA XS Classic and Advanced instances carry Dispatchers too. If a window cannot open immediately, disabling WebSocket support blocks ICM2SHELL as a last resort, knowing it breaks push channels and some Fiori features.
Everyone (non-IT)
If your employer runs SAP, expect an urgent maintenance window this week and possibly brief sign-in changes while the SAML fix lands. That urgency is justified: these flaws let an outsider reach the company core systems without a password. There is nothing for individual staff to install and no message about SAP that should ask for your credentials. Report any such message to your IT team rather than answering it, and plan around the window the team announces instead of working around it.