SAP patches four maximum-severity NetWeaver flaws that need no login
Attackers reaching affected SAP systems over the network could run code or log in as any user, so patching is the only fix for the SAML2 flaw.
SAP's November 2026 Security Patch Day fixed four flaws rated 10.0 on CVSS that can be exploited without logging in, three in the NetWeaver application server and one in its Web Dispatcher. The Web Dispatcher and ICM flaws (CVE-2026-89126 and CVE-2026-76964) let crafted network traffic corrupt memory and run code, and Onapsis, which reported them, calls the combined issue ICM2SHELL. A SAML2 service provider flaw (CVE-2026-120017) could let attackers log in as any user on some single sign-on setups, including privileged accounts, and it has no workaround so patching is the only fix. The SAP Gateway flaw (CVE-2026-89103), dubbed PROXYGATE, lets an outside attacker pose as one of the system's own application servers and reach command execution, and it affects kernel versions already out of maintenance. Teams should patch the kernel and every Web Dispatcher together, and check that Gateway access control lists are explicit and that the gateway port is unreachable from user networks.
Why it matters
For companies that run SAP's NetWeaver application server, the exposure is wide because these flaws can be used without a login and some have no workaround. Organisations whose SAP systems are reachable from outside their internal networks are the most exposed, and the November update means those gaps are now documented and fixed. Privileged accounts on single sign-on setups are at particular risk if the SAML2 flaw is left unpatched. The rating, the public names given to the flaws and the number of critical fixes in the same release all signal that unpatched SAP estates are a live target.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.