Title: SAP November 2026 Patch Day: Four Pre-Authentication CVSS 10.0 Flaws in NetWeaver Components
Summary: SAP’s November 2026 Security Patch Day (November 10) shipped 35 new security notes plus 4 GitHub advisories and 3 updates, the vendor urging priority application. Four of this month’s notes are rated Critical with the maximum CVSS score of 10.0 and each is exploitable without any login, per SAP’s bulletin and The Hacker News: CVE-2026-76964, a memory corruption in the SAP NetWeaver AS ABAP Internet Communication Manager (Note 3778530, KRNL64UC 7.53, KERNEL 7.53/7.54/7.77/7.93/9.16/9.18/9.20); CVE-2026-89126, a memory corruption in SAP Web Dispatcher (Note 3778556); CVE-2026-89103, broken access control in SAP Gateway (Note 3798345); and CVE-2026-120017, missing authentication in the SAML2 service provider of NetWeaver AS ABAP and ABAP Platform (Note 3849308, affecting SAP_BASIS 702, 731, 740, 750 through 758, 816, and 920 through 922). Onapsis, whose researchers found the ICM, Web Dispatcher and Gateway flaws (per The Hacker News), traces the ICM and Web Dispatcher bugs to a single kernel defect — dubbed ICM2SHELL — in shared WebSocket message-reassembly code, where crafted traffic corrupts memory and can run operating-system commands as the system’s <sid>adm account; WebSocket support is on by default, so exposure doesn’t depend on anyone using the feature, and the same bug can crash a Web Dispatcher, taking every SAP system behind it offline. The Gateway flaw (dubbed PROXYGATE) turns on the gateway’s proxy access list (prxyinfo) or the gw/acl_mode_proxy profile parameter rather than the secinfo/reginfo lists most hardening guides cover: the default configuration lets an external attacker impersonate one of the system’s own application servers and run OS commands as <sid>adm, and it affects AS Java, dual-stack and standalone gateway installs. For SAML2, the service provider failed to check signatures on incoming assertions under certain configurations, letting an attacker log in as any user — including privileged ones. Onapsis also warns that kernels already out of maintenance are affected and may not receive fixes: its ICM2SHELL advisory lists 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 for the ICM and Web Dispatcher flaws, and its PROXYGATE advisory adds 7.20 and 7.21 for the Gateway flaw, so systems on those releases need an upgrade to a still-maintained kernel. SAP recommends applying the four notes as a priority. For Gateway systems that cannot be patched at once, Onapsis advises moving on the proxy access control list first: restricting prxyinfo lowers exposure during the wait, with internet-reachable gateways handled first, and where no prxyinfo file exists the gw/acl_mode_proxy profile parameter governs and should be set to 1 — patching the kernel by itself still leaves a system exposed unless one of those controls is in place. Disabling WebSocket support on ICM or Web Dispatcher is a last-resort mitigation that breaks features relying on it. RedRays’ Patch Day analysis, meanwhile, advises a single rollout covering this month’s 17 kernel and Web Dispatcher fixes — the kernel and every Web Dispatcher together.
References: