S4CRM - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/s4crm/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 15:52:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSAP NetWeaver, Web Dispatcher, and Gateway Critical Vulnerabilitieshttps://feed.craftedsignal.io/briefs/2026-11-sap-patches/Tue, 10 Nov 2026 15:52:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-sap-patches/SAP released 42 security notes, including nine critical-severity vulnerabilities such as ICM2SHELL and ProxyGate, which allow unauthenticated remote code execution with <sid>adm privileges.SAP published its November 2026 security bulletin containing 42 new and updated security notes. Nine of these are rated critical, including maximum-severity flaws in NetWeaver, Web Dispatcher, and Gateway components. Key vulnerabilities include ICM2SHELL (CVE-2026-76964, CVE-2026-89126) related to improper WebSocket message fragmentation handling, and ProxyGate (CVE-2026-89103) involving a bypass of the prxyinfo access-control list. Both vulnerabilities permit unauthenticated remote code execution (RCE) with <sid>adm privileges. Additionally, CVE-2026-120017 addresses a missing authentication bug in NetWeaver that can lead to full system compromise via user impersonation.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands with <sid>adm privileges, resulting in full control over affected SAP systems. Researchers have confirmed that a working exploit exists for ICM2SHELL, which reproduces on multiple SAP Kernel releases.

Recommendation

  • Immediately identify all SAP environments using the affected NetWeaver, Web Dispatcher, and Gateway components.
  • Prioritize patching the nine critical vulnerabilities listed in the November 2026 SAP security bulletin, specifically focusing on CVE-2026-76964, CVE-2026-89126, and CVE-2026-89103.
  • Review and harden the prxyinfo access-control list configurations to restrict Gateway access to trusted networks only.
  • Consult the official SAP security portal for the full list of 42 notes and apply available patches as directed.
]]>criticaladvisory