THE CRUNCH

SAP has released 42 new and updated security advisories for November 2026, nine of which fix critical-severity vulnerabilities. Four notes address maximum-severity flaws in NetWeaver, Web Dispatcher and Gateway, including two in the Internet Communication Manager (ICM) and Web Dispatcher tracked as CVE-2026-76964 and CVE-2026-89126. The weakness sits in the SAP kernel component that receives HTTP, HTTPS and WebSocket traffic, and stems from how large WebSocket messages split into fragments are reassembled. Security firm Onapsis, which calls the defect ICM2SHELL, says a crafted sequence of WebSocket messages can make the component write attacker-controlled data beyond reserved memory, causing a crash or memory corruption.

Onapsis says it gave SAP a working exploit achieving full, unauthenticated remote code execution, running arbitrary commands as the adm user on the target system. It adds that the denial-of-service condition reproduced on every SAP Kernel release tested.

The other maximum-severity flaw, CVE-2026-89103 in SAP Gateway and dubbed ProxyGate, could let unauthenticated attackers achieve remote code execution without user interaction. It involves the prxyinfo access-control list, which should restrict requests to trusted networks; if left open, attackers can send requests that appear to come from an internal network and trick the gateway into accepting them, again gaining adm privileges and full control without a username, password or certificate.

Because the flaw is in the SAP kernel, Onapsis notes it affects a broad range of releases, including kernel versions already out of maintenance, and the gateway runs on ABAP as well as AS Java, dual-stack and standalone-gateway systems. SAP also fixed a maximum-severity missing authentication bug in NetWeaver, CVE-2026-120017, which in certain configurations could let unauthenticated attackers impersonate arbitrary users and potentially fully compromise the system. The remaining five critical notes cover NetWeaver, S4CRM, Web Dispatcher and BusinessObjects, and SAP published 17 high-severity fixes alongside them. Including updates to notes on the recently disclosed PHP2Shell and Node2Shell vulnerabilities in its Business AI Platform, Onapsis counts 43 new and updated notes this month.