Software giant SAP has released its November 2026 security patch bundle, addressing 35 different vulnerabilities in its systems. This bundle includes fixes for four extremely critical vulnerabilities that hold the maximum score on the Common Vulnerability Scoring System (CVSS).
The four maximum-severity vulnerabilities affect key components in the company's architecture, specifically NetWeaver, Web Dispatcher, and Gateway systems. The company fixed two vulnerabilities in the NetWeaver application server (ABAP) related to memory corruption and missing authentication, in addition to an access control breakage vulnerability in the SAP Gateway and another memory corruption vulnerability in the Web Dispatcher component.
Nature of the Threat and Discovered Vulnerabilities
Cybersecurity firm Onapsis, which discovered and reported three of these issues, tracked two vulnerabilities under the names ICM2SHELL and a third vulnerability under the name PROXYGATE. The ICM2SHELL vulnerability allows attackers to exploit normal entry point traffic to execute remote code without requiring a username, password, or any human interaction.
As for the PROXYGATE vulnerability, it works by tricking the SAP Gateway into believing that an unauthenticated external attacker is one of the internal application servers, granting the attacker full control over the SAP system with the privileges of the account that owns the installation process. This directly endangers business data, transaction integrity, and application availability.
What Changes Practically?
These updates indicate the company's ongoing efforts to address serious vulnerabilities in core enterprise infrastructure components. It is worth noting that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has previously documented numerous SAP vulnerabilities that were actively exploited in attacks, making the immediate application of these patches an utmost necessity for organizations that rely on these systems to manage their operations and sensitive business transactions.