What happened. On Nov 10, SAP published its November security notes: SAP lists 35 new notes plus updates, and Onapsis counts a record 43 new and updated notes including 12 HotNews (SAP's top-priority) notes. Four fixes carry the maximum CVSS 10.0 score, in NetWeaver's Internet Communication Manager (ICM), Web Dispatcher, SAML2 Service Provider and Gateway.
ICM2SHELL (CVE-2026-76964, CVE-2026-89126). The ICM is the SAP kernel piece that takes in HTTP, HTTPS and WebSocket traffic, and the Web Dispatcher is the SAP load balancer that often faces the internet. Onapsis says a crafted sequence of fragmented WebSocket messages makes either one write attacker data past the memory it reserved, which either crashes the process or lets the attacker run OS commands as the <sid>adm admin user. WebSocket support is on by default, S/4HANA ships services that accept WebSockets without a login, and any ABAP system on kernel 7.40 or later is exposed, including the Web Dispatcher built into SAP HANA XS. Onapsis says it gave SAP a working, unauthenticated end-to-end exploit. Fixes are SAP Notes 3778530 and 3778556.
PROXYGATE (CVE-2026-89103). SAP Gateway ships with a default access list that can treat an outside attacker as a trusted internal app server, so a series of requests with no username, password or certificate can end in OS commands as the admin user. It hits ABAP, Java, dual-stack and standalone gateways, including out-of-maintenance kernels. SAP Note 3798345 fixes it, but Onapsis notes you must also set a profile parameter by hand after patching. The fourth CVSS 10 fix (CVE-2026-120017) is a missing-authentication bug in NetWeaver that can let attackers impersonate any user in certain setups.
Why this matters to an enterprise. SAP runs finance, payroll and supply chain, and full control of the kernel process means control of that data. Two pre-auth bugs at the HTTP front door and the RFC gateway, with a working exploit already written, is the pattern that preceded fast exploitation of past SAP flaws. Patch the kernel and Web Dispatcher first (internet-facing ones before internal), apply the Gateway note plus its manual parameter, and limit who can reach Gateway and Web Dispatcher ports until you do.