SAP's November patch day: max-severity kernel and gateway flaws, with a working exploit already handed over
SAP published 42 new and updated notes, nine of them critical. Two of the maximum-severity bugs sit in the kernel, which means the affected release list runs past the versions still in maintenance.
On this page
SAP released 42 new and updated security notes on Tuesday, nine of them for critical-severity bugs, according to SecurityWeek's write-up published on 10 November 2026. Four of the new notes cover maximum-severity flaws: two in NetWeaver (Internet Communication Manager and the SAML2 Service Provider), one in Web Dispatcher, one in Gateway.
The two that matter most for anyone running SAP are the kernel bugs, because the kernel is the part you can't easily route around.
What happened
The ICM and Web Dispatcher flaws are one weakness in the SAP kernel component that handles HTTP, HTTPS and WebSocket traffic. Onapsis, which named it ICM2SHELL, says it's in how large WebSocket messages get reassembled: a message can be split into fragments during a browser-server exchange and put back together by the receiver. A crafted sequence of WebSocket messages makes ICM or Web Dispatcher write attacker-controlled data past the end of the memory reserved for the connection. Depending on how that data is shaped, the process either crashes or its memory is corrupted in a controlled way.
Onapsis says the outcome can be OS command execution as adm. It also says its researchers gave SAP a working exploit that achieves full unauthenticated remote code execution end to end, and that the denial-of-service condition reproduced on every SAP kernel release they tested. That's the vendor-adjacent research firm's account, not something SAP's advisory text states.
The Gateway bug, called ProxyGate, is about the prxyinfo access-control list, which is supposed to limit requests to trusted networks. Left open, it lets an attacker send a series of requests that look like they came from an internal network, and the gateway accepts them. No username, password or certificate needed. Onapsis notes the gateway runs on ABAP, AS Java, dual-stack and standalone-gateway systems, and that because the flaw is in the kernel it reaches releases already out of maintenance.
SAP also fixed a maximum-severity missing authentication bug in NetWeaver's SAML2 Service Provider. Under certain configurations, an unauthenticated attacker could submit crafted data and impersonate arbitrary users, including privileged ones, which the advisory describes as potentially a full system compromise with impact reaching connected systems.
The other critical notes cover NetWeaver XML Forms, S4CRM, Web Dispatcher and BusinessObjects Web Intelligence. SAP added 17 high-severity fixes on top, for memory corruption, denial of service and information disclosure bugs.
Why the kernel placement matters
Most SAP patch days are a list of notes you triage by component and business process. This one is different in kind. ICM and the gateway sit in front of, or underneath, the applications. A flaw there doesn't care which module you've hardened or which user roles you've trimmed. The exposure is the listener and the network path to it.
The out-of-maintenance point is the one we'd underline. Kernel patches are usually applied as a kernel update, not a note transport, and plenty of estates run old kernels under newer application stacks because nothing forced an upgrade. Onapsis says the DoS reproduced on every kernel release it tested, which is a claim about breadth, not a count of affected systems. Nobody has published how many installations are exposed.
HackZoneLabs assessment
In our view the ICM2SHELL and ProxyGate pair deserves to jump the queue ahead of the SAML2 note, even though the SAML2 bug carries the higher headline score. The reason is reachability: a working unauthenticated RCE chain reportedly exists for ICM2SHELL, and the gateway flaw needs no credentials at all. A pre-auth kernel bug with a demonstrated exploit is the kind of thing that gets picked up by people who read patch diffs, and the window between patch and exploitation is usually short. We'd treat the SAML2 issue as serious but configuration-dependent, since the advisory ties it to "certain configurations" and doesn't say how common those are.
We'd also be a bit suspicious of any internal inventory that says "we're on a supported kernel." The out-of-maintenance claim from Onapsis is the sort of thing that turns out to be true in more places than the CMDB suggests.
What remains unknown
SAP's notes are behind a support login, so the public record here is the CNA descriptions plus Onapsis's account relayed by SecurityWeek. We haven't seen the notes themselves. The advisories don't say whether exploitation has been observed in the wild, and no one has published a write-up of an actual intrusion tied to either bug. The patch status field in the CVE records is an editor annotation, not a vendor statement.
What to check first
- Whether your kernel release is on the fixed level for the ICM and Web Dispatcher notes, including systems you believe are out of maintenance.
- The prxyinfo ACL on every gateway, including standalone gateway hosts and AS Java or dual-stack systems, not just the ABAP stack your team thinks about.
- Whether the SAML2 Service Provider is configured in a way the note describes as affected, and who can reach it.
- The remaining critical notes by component: XML Forms, S4CRM, Web Dispatcher, BusinessObjects Web Intelligence.
The 17 high-severity fixes are worth a pass too, but they're the usual background noise of a SAP patch day. The kernel is not.
CVE references
Sources
- SAP Patches Critical ICM2SHELL, ProxyGate VulnerabilitiesPrimarywww.securityweek.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning