{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/businessobjects/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-109795"},{"cvss":9.1,"id":"CVE-2026-109798"},{"cvss":9.9,"id":"CVE-2026-109803"},{"cvss":10,"id":"CVE-2026-120017"},{"cvss":10,"id":"CVE-2026-76964"},{"cvss":9.9,"id":"CVE-2026-76965"},{"cvss":10,"id":"CVE-2026-89103"},{"cvss":9.6,"id":"CVE-2026-89119"},{"cvss":10,"id":"CVE-2026-89126"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NetWeaver","Web Dispatcher","Gateway","S4CRM","BusinessObjects","SAP Software"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["SAP"],"content_html":"\u003cp\u003eSAP published its November 2026 security bulletin containing 42 new and updated security notes. Nine of these are rated critical, including maximum-severity flaws in NetWeaver, Web Dispatcher, and Gateway components. Key vulnerabilities include ICM2SHELL (CVE-2026-76964, CVE-2026-89126) related to improper WebSocket message fragmentation handling, and ProxyGate (CVE-2026-89103) involving a bypass of the prxyinfo access-control list. Both vulnerabilities permit unauthenticated remote code execution (RCE) with \u0026lt;sid\u0026gt;adm privileges. Additionally, CVE-2026-120017 addresses a missing authentication bug in NetWeaver that can lead to full system compromise via user impersonation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary operating system commands with \u0026lt;sid\u0026gt;adm privileges, resulting in full control over affected SAP systems. Researchers have confirmed that a working exploit exists for ICM2SHELL, which reproduces on multiple SAP Kernel releases.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately identify all SAP environments using the affected NetWeaver, Web Dispatcher, and Gateway components.\u003c/li\u003e\n\u003cli\u003ePrioritize patching the nine critical vulnerabilities listed in the November 2026 SAP security bulletin, specifically focusing on CVE-2026-76964, CVE-2026-89126, and CVE-2026-89103.\u003c/li\u003e\n\u003cli\u003eReview and harden the prxyinfo access-control list configurations to restrict Gateway access to trusted networks only.\u003c/li\u003e\n\u003cli\u003eConsult the official SAP security portal for the full list of 42 notes and apply available patches as directed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T16:30:47Z","date_published":"2026-11-10T15:52:05Z","id":"https://feed.craftedsignal.io/briefs/2026-11-sap-patches/","summary":"SAP released 42 security notes, including nine critical-severity vulnerabilities such as ICM2SHELL and ProxyGate, which allow unauthenticated remote code execution with \u003csid\u003eadm privileges.","title":"SAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2026-11-sap-patches/"}],"language":"en","title":"CraftedSignal Threat Feed - BusinessObjects","version":"https://jsonfeed.org/version/1.1"}