Skip to content
Threat Feed
Subscribe
critical advisory

SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities

SAP released 42 security notes, including nine critical-severity vulnerabilities such as ICM2SHELL and ProxyGate, which allow unauthenticated remote code execution with <sid>adm privileges.

CVE search metadata

CVE search record: CVE-2026-109795. Severity: critical. CVSS: 9.9. KEV: no. Product: NetWeaver, Web Dispatcher, Gateway, S4CRM, BusinessObjects, SAP Software. Brief: SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-11-sap-patches/

CVE search record: CVE-2026-109798. Severity: critical. CVSS: 9.1. KEV: no. Product: NetWeaver, Web Dispatcher, Gateway, S4CRM, BusinessObjects, SAP Software. Brief: SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-11-sap-patches/

CVE search record: CVE-2026-109803. Severity: critical. CVSS: 9.9. KEV: no. Product: NetWeaver, Web Dispatcher, Gateway, S4CRM, BusinessObjects, SAP Software. Brief: SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-11-sap-patches/

CVE search record: CVE-2026-120017. Severity: critical. CVSS: 10.0. KEV: no. Product: NetWeaver, Web Dispatcher, Gateway, S4CRM, BusinessObjects, SAP Software. Brief: SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-11-sap-patches/

CVE search record: CVE-2026-76964. Severity: critical. CVSS: 10.0. KEV: no. Product: NetWeaver, Web Dispatcher, Gateway, S4CRM, BusinessObjects, SAP Software. Brief: SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-11-sap-patches/

CVE search record: CVE-2026-76965. Severity: critical. CVSS: 9.9. KEV: no. Product: NetWeaver, Web Dispatcher, Gateway, S4CRM, BusinessObjects, SAP Software. Brief: SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-11-sap-patches/

CVE search record: CVE-2026-89103. Severity: critical. CVSS: 10.0. KEV: no. Product: NetWeaver, Web Dispatcher, Gateway, S4CRM, BusinessObjects, SAP Software. Brief: SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-11-sap-patches/

CVE search record: CVE-2026-89119. Severity: critical. CVSS: 9.6. KEV: no. Product: NetWeaver, Web Dispatcher, Gateway, S4CRM, BusinessObjects, SAP Software. Brief: SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-11-sap-patches/

CVE search record: CVE-2026-89126. Severity: critical. CVSS: 10.0. KEV: no. Product: NetWeaver, Web Dispatcher, Gateway, S4CRM, BusinessObjects, SAP Software. Brief: SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities. Brief link: https://feed.craftedsignal.io/briefs/2026-11-sap-patches/

Triage facts

Revision 2
Applicability
NetWeaver, Web Dispatcher +4
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
2 public sources
Freshness
Revision 2Nov 10, 16:31 UTC
Vulnerabilities
9 CVEs
Source quality
C3Roughly even chance
Revision history 1 entry · Revision 2
  1. Revision 2

    added coverage for SAP Software

    Changed: action_plan, affected_products, lastmod, references, updates

    Sources: 1

SAP published its November 2026 security bulletin containing 42 new and updated security notes. Nine of these are rated critical, including maximum-severity flaws in NetWeaver, Web Dispatcher, and Gateway components. Key vulnerabilities include ICM2SHELL (CVE-2026-76964, CVE-2026-89126) related to improper WebSocket message fragmentation handling, and ProxyGate (CVE-2026-89103) involving a bypass of the prxyinfo access-control list. Both vulnerabilities permit unauthenticated remote code execution (RCE) with <sid>adm privileges. Additionally, CVE-2026-120017 addresses a missing authentication bug in NetWeaver that can lead to full system compromise via user impersonation.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands with <sid>adm privileges, resulting in full control over affected SAP systems. Researchers have confirmed that a working exploit exists for ICM2SHELL, which reproduces on multiple SAP Kernel releases.

Recommendation

  • Immediately identify all SAP environments using the affected NetWeaver, Web Dispatcher, and Gateway components.
  • Prioritize patching the nine critical vulnerabilities listed in the November 2026 SAP security bulletin, specifically focusing on CVE-2026-76964, CVE-2026-89126, and CVE-2026-89103.
  • Review and harden the prxyinfo access-control list configurations to restrict Gateway access to trusted networks only.
  • Consult the official SAP security portal for the full list of 42 notes and apply available patches as directed.

Immediate actions

Patch critical SAP vulnerabilities per November 2026 bulletin

IT Operations 48h

Inventory SAP software versions

IT Operations 48h

Threat Hunt

Identify unauthenticated attempts to manipulate WebSocket fragments in ICM/Web Dispatcher logs

T1203 high medium confidence hunt now

Data: SAP ICM/Web Dispatcher internal trace and access logs

Audit Gateway prxyinfo configurations for permissive access

T1190 high high confidence hunt now

Data: SAP Gateway configuration files (prxyinfo)

Mitigations

Apply security notes released in the November 2026 SAP bulletin

immediate IT Operations

CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017, CVE-2026-109803, CVE-2026-76965, CVE-2026-109795, CVE-2026-89119, CVE-2026-109798

Apply relevant SAP security patches for November 2026

immediate IT Operations

Multiple SAP security vulnerabilities