CriticalMalware
Hackers Can Exploit SAP PROXYGATE and ICM2SHELL Flaws for Unauthorized Full System Access
Cyber Security News·Source published ·1 min read
What happened?
SAP has released fixes for PROXYGATE and ICM2SHELL, critical security flaws that could let attackers take control of SAP systems without signing in. Disclosed during the November 10, 2026, Security Patch Day, the vulnerabilities carry maximum CVSS scores of 10.0 and affect core components used across business applications. Onapsis Research Labs discovered and reported both issues. The flaws allow attackers with network access to run operating system commands under the adm account, which owns the SAP installation.
Key details
- SAP released fixes for two critical flaws disclosed November 10 2026 with maximum CVSS scores of 10.0.
- PROXYGATE exploits gateway trust decisions; crafted requests can make external attackers appear internal when proxy policy allows the connection.
- ICM2SHELL CVE-2026-76964 and CVE-2026-89126 involve memory corruption in kernel code processing WebSocket traffic on HTTP HTTPS ports.
- WebSocket support enabled by default allows attackers to execute commands or crash services without authentication on some S/4HANA services.
- Onapsis reported no observed exploitation at publication but warns environments may still be at risk.
Affected
- Internet Communication Manager and SAP Web Dispatcher including SAP HANA XS component.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.