SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software.
The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components.
NetWeaver is the core app platform that underpins SAP's business software and handles application integration, authentication, user management, and data processing.
The other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher.
Gateway is a core framework that enables external apps to securely connect to SAP backend systems, while Web Dispatcher (deployed in almost every enterprise SAP environment) is a specialized component that acts as a load balancer and reverse proxy for web requests entering an SAP system architecture.
Cybersecurity firm Onapsis, which found and reported three of these security issues, collectively tracks CVE-2026-76964 and CVE-2026-89126 as ICM2SHELL and the CVE-2026-89103 pre-auth remote code execution vulnerability as PROXYGATE.
"ICM2SHELL turns a routine part of web traffic into a point of ingress for attackers. [..] The result is remote code execution against the component that faces the network by design: no SAP user, no password and no user interaction," Onapsis said.
"PROXYGATE works by convincing the SAP Gateway that an unauthenticated, external attacker is one of the internal application servers. [..] There is no SAP user, no password, and no user interaction, yet full control of the SAP system as the account that owns the installation is achieved. On a production ERP system, that means direct exposure of the business data, transaction integrity, and the availability of critical business applications."
SAP rated these four vulnerabilities 10/10 on the CVSS severity scale, stating that unauthenticated attackers can exploit them to fully compromise the targeted systems remotely.
More recently patched max severity SAP security issues
These are the latest in a string of other maximum-severity flaws SAP has fixed in multiple components in recent months.
For instance, it patched CVE-2026-58231 in the Commerce Cloud cloud-based e-commerce platform in August, which threat intelligence firm Defused flagged as actively exploited in attacks days after the patch.
It also addressed two more max severity flaws in September and October: a memory corruption flaw in the SAP Kernel code (tracked as CVE-2026-44756 and dubbed OVERPASS by Onapsis security researchers who reported it) and an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications (CVE-2026-89111).
The US Cybersecurity and Infrastructure Security Agency (CISA) has flagged 14 SAP security flaws as actively exploited since November 2021, three of which ransomware groups also abused in the wild.
SAP is a German multinational software company that reported revenues exceeding €36 billion in fiscal year 2025 and serves 99 of the 100 largest companies worldwide.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.