SAP NetWeaver flaws rated 10 out of 10 let attackers take over systems without a login (CVE-2026-76964)

12 November 2026Critical 10.0

SAP · SAP NetWeaver AS ABAP, SAP Web Dispatcher and SAP Gateway · CVE-2026-76964

SAP NetWeaver flaws rated 10 out of 10 let attackers take over systems without a login

SAP's 10 November patch day fixed four flaws with the maximum CVSS score of 10. Two of them, CVE-2026-76964 and CVE-2026-89126 (nicknamed ICM2SHELL), are memory bugs in the parts of SAP that receive web traffic; the researchers at Onapsis say they need no credentials, no user action and no misconfiguration. The others are CVE-2026-89103 in SAP Gateway (PROXYGATE) and CVE-2026-120017, a missing login check in the SAML2 Service Provider. Onapsis says it has not seen ICM2SHELL exploited in the wild.

Affected: SAP NetWeaver AS ABAP (Internet Communication Manager) on kernel 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20; SAP Web Dispatcher, including the one inside SAP HANA; SAP Gateway on kernels from 7.22 to 9.21; and the SAML2 Service Provider in NetWeaver AS ABAP and ABAP Platform. Onapsis notes that for ICM2SHELL, Java-only systems and kernel 7.22 are not affected, and that out-of-maintenance kernels 7.40 to 7.89 are affected and may not get a fix.
What to do: Apply SAP Security Notes 3778530 and 3778556 (ICM2SHELL), 3798345 (SAP Gateway) and 3849308 (SAML2), starting with anything reachable from the internet. SAP Note 3778788 is the FAQ with workarounds and SAP Note 3849055 covers Private Cloud customers. If you cannot patch at once, Onapsis describes SAP's temporary workaround of setting icm/HTTP/support_websocket_upgrade=FALSE and restarting, after checking nothing relies on WebSocket, and limiting network access to the HTTP and HTTPS ports.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Four maximum-severity flaws in one patch day, in business software that runs finance and operations at many firms; widely covered.

SAP NetWeaver flaws rated 10 out of 10 let attackers take over systems without a login

Affected

SAP NetWeaver AS ABAP (Internet Communication Manager) on kernel 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20; SAP Web Dispatcher, including the one inside SAP HANA; SAP Gateway on kernels from 7.22 to 9.21; and the SAML2 Service Provider in NetWeaver AS ABAP and ABAP Platform. Onapsis notes that for ICM2SHELL, Java-only systems and kernel 7.22 are not affected, and that out-of-maintenance kernels 7.40 to 7.89 are affected and may not get a fix.

What to do

Apply SAP Security Notes 3778530 and 3778556 (ICM2SHELL), 3798345 (SAP Gateway) and 3849308 (SAML2), starting with anything reachable from the internet. SAP Note 3778788 is the FAQ with workarounds and SAP Note 3849055 covers Private Cloud customers. If you cannot patch at once, Onapsis describes SAP's temporary workaround of setting icm/HTTP/support_websocket_upgrade=FALSE and restarting, after checking nothing relies on WebSocket, and limiting network access to the HTTP and HTTPS ports.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Four maximum-severity flaws in one patch day, in business software that runs finance and operations at many firms; widely covered.