Urgent Security Updates from SAP
SAP announced the release of 42 new and updated security notes, including nine vulnerabilities classified as "Critical," requiring system administrators to take immediate action to secure work environments. These updates target core components in enterprise software, including NetWeaver, Web Dispatcher, and Gateway.
ICM2SHELL and ProxyGate Vulnerabilities
Among the most dangerous vulnerabilities stands ICM2SHELL (registered under CVE-2026-76964 and CVE-2026-89126), which affects the Internet Communication Manager (ICM) and Web Dispatcher components. This vulnerability arises from a flaw in handling large WebSocket messages, where an attacker can send a specially crafted sequence of messages leading to a buffer overflow beyond allocated memory limits, allowing the execution of operating system commands with <sid>adm privileges.
As for the ProxyGate vulnerability (registered under CVE-2026-89103), it affects the SAP Gateway. This vulnerability allows unauthenticated attackers to bypass access restrictions in the prxyinfo list, tricking the system into believing that requests are coming from a trusted internal network, which grants the attacker full control over the SAP system without the need for a username or password.
Why This News Matters
The severity of these vulnerabilities lies in the fact that they reside within the SAP Kernel, meaning they affect a wide range of versions, including those that have passed the official support period. Given that the vulnerabilities allow for Remote Code Execution (RCE) without user interaction, they pose a direct threat to business continuity and the safety of sensitive data within organizations relying on SAP platforms.
Additional Details on Updates
In addition to the aforementioned vulnerabilities, SAP addressed an authentication bypass vulnerability in NetWeaver (CVE-2026-120017) that could allow impersonation of any user. The update package also included five other critical vulnerabilities in various components such as S4CRM and BusinessObjects, along with 17 other vulnerabilities classified as "high severity" related to memory corruption and Denial of Service (DoS).
IT administrators are advised to review the security notes issued by SAP immediately and apply the available updates, especially in light of confirmation from Onapsis security researchers regarding active exploitation of these vulnerabilities.