Four Perfect Scores. Zero Logins Needed.

SAP’s November Patch Day landed with a warning that is hard to overstate: four separate flaws, each rated 10.0 out of 10 — the maximum severity score — and none of them requires an attacker to log in first. SAP fixed all four in its monthly security bulletin, and the vendor’s advice is blunt: apply them as a priority.

Three sit in SAP NetWeaver, the application server most SAP systems run on. The fourth is in the Web Dispatcher, which receives web requests from the internet and passes them on. Together, they cover just about every way an attacker can reach an SAP system from the outside.

The four flaws

CVE-2026-76964 — the Internet Communication Manager (ICM). The ICM handles the server’s web traffic. Crafted network traffic can corrupt its memory, letting an attacker run code and take over the whole system. Researchers at Onapsis, who found the flaw, call it ICM2SHELL. They gave SAP a working exploit that runs operating system commands as the account that owns the SAP installation.

CVE-2026-89126 — the Web Dispatcher. The same bug, in shared code: both use the same kernel code to put split WebSocket messages back together, so one flaw breaks both. A crashed Web Dispatcher cuts off every SAP system behind it while it restarts. WebSocket support is on by default, so a system is exposed even if nothing uses it.

CVE-2026-89103 — SAP Gateway. The Gateway connects the server to other SAP systems and programs, and it uses access control lists to decide which outside programs may connect. This flaw makes the gateway switch on its default list with high privileges, so an outside attacker gets treated as one of the system’s own application servers — and can then run operating system commands for the attacker. Onapsis calls it PROXYGATE. It affects any system that runs a gateway, including standalone installations.

CVE-2026-120017 — SAML 2.0 single sign-on. On some systems that hand sign-in off to an identity provider, the service provider did not check signatures on incoming assertions. An attacker could log in as any user — including privileged users — and a full compromise could follow, possibly reaching connected systems. There is no workaround.

Why this one is different

The researchers have not seen these flaws exploited yet, but working exploits exist: ICM2SHELL runs commands as the SAP owner account, and the Gateway flaw was demonstrated end to end in a proof of concept shared with SAP. The gap between “proof of concept” and “in the wild” has been measured in hours this year — the OpenSSH flaw known as SSHole saw its first exploitation attempt less than nine hours after disclosure, and sixteen break-ins were confirmed within days.

There is another trap. Kernels that are out of maintenance are affected too — Onapsis lists kernels 7.40 through 7.89 — and those may never get a fix. The only way out is an upgrade to a maintained kernel. And on release 7.93, a higher patch level is not always a fixed one: patch level 419 is still vulnerable, and only the updated 401 Stack Kernel, 402 once released, and 420 or later carry the fix.

The Gateway flaw has its own quiet danger. Exposure depends on the gateway’s proxy list, known as prxyinfo, or on a profile parameter where that list is missing — not on the secinfo and reginfo lists most hardening guidance covers. A permissive proxy list leaves a system exposed at any patch level, and the parameter that controls it ships set to allow every proxy connection. The kernel patch alone, without a restrictive prxyinfo or that parameter set to 1, does not take a system out of scope.

What to do now

RedRays, a firm that reviewed the notes, advises updating the kernel and all Web Dispatchers in a single rollout, covering all 17 of this month’s kernel and Web Dispatcher fixes. Find every Web Dispatcher first — one missed instance leaves the flaw open — and remember a patched Web Dispatcher can shield the ICM behind it only if nobody can reach the ICM ports directly, and not on one set up as a router.

Four checks to run this week:

• Inventory every SAP system and gateway. List all kernels, Web Dispatchers, and standalone gateways, including the ones nobody has touched in years. Out-of-maintenance kernels need an upgrade plan, not a patch.
• Check the gateway proxy list first. Review prxyinfo on every gateway, starting with any that can be reached from the internet, and set the gw/acl_mode_proxy parameter to 1. Limit gateway ports 33NN and 48NN to hosts that genuinely need RFC access.
• Review SAML sign-in logs. Check every trusted identity provider in transaction SAML2 and look for sign-ins by privileged users from unexpected sources.
• Patch in one rollout, then verify. Apply the kernel and Web Dispatcher fixes together, confirm the patch levels actually carry the fix — especially on 7.93 — and treat turning off WebSocket support as a last resort, since it breaks features that depend on it.

SAP’s bulletin carries the full list of affected versions and fix notes, and the vendor strongly recommends applying them as a priority. It is the same pattern as the SonicWall flaw that landed on CISA’s exploited list with a hard November 20 deadline: a perfect score, a working exploit, and a short window before attackers catch up. Patch first, hunt second.