SAP Patches ICM2SHELL and PROXYGATE Maximum-Severity Flaws

Summary

SAP's November 2026 security updates address 35 vulnerabilities, four of them rated 10.0 on the CVSS scale. SAP says unauthenticated attackers could exploit them remotely to fully compromise affected systems. Onapsis named two of the issue groups ICM2SHELL and PROXYGATE.

The Four Maximum-Severity Flaws

ICM2SHELL

Web Dispatcher acts as a load balancer and reverse proxy, and ICM handles web traffic for the ABAP stack. Per Onapsis, the memory-corruption flaws give attackers remote code execution against this network-facing component, with no SAP user, password, or user interaction required.

PROXYGATE

CVE-2026-89103 is a pre-authentication remote code execution flaw. According to Onapsis, it tricks SAP Gateway into treating an unauthenticated external attacker as an internal application server, giving full control of the SAP system under the account that owns the installation.

Exploitation Status

The reporting does not say whether these four flaws are being exploited in the wild. For context, CVE-2026-58231 (SAP Commerce Cloud, patched in August) was flagged as actively exploited days after its patch, and CISA has listed 14 SAP flaws as actively exploited since November 2021, three of which ransomware groups have abused.

Recommended Actions

1. Apply the November 2026 SAP Security Patch Day updates. Consult SAP's security notes for affected versions and kernel levels, since the coverage does not list them.
2. Prioritize internet-facing Web Dispatcher, ICM, and Gateway instances.
3. Restrict network access to SAP Gateway and ICM ports to trusted segments.
4. Review recent SAP logs for unexpected connections to these services.

Source

• BleepingComputer: SAP patches ICM2SHELL and PROXYGATE maximum severity flaws