netweaver

SAP Patch Day: Four Critical CVSS 10.0 Pre-Auth Flaws Fixed in NetWeaver Components

SAP fixed four unauthenticated CVSS 10.0 flaws on November Patch Day — ICM, Web Dispatcher, SAP Gateway and SAML2 service provider, including two pre-auth RCE paths Onapsis researchers call ICM2SHELL and PROXYGATE.