SAP released 35 new security notes, 4 GitHub advisories and 3 updates on its 10 November 2026 patch day. SecurityWeek reported nine critical fixes, four of them top severity, in NetWeaver, Web Dispatcher and Gateway. Onapsis, a security firm, named two: ICM2SHELL (CVE-2026-76964, CVE-2026-89126) and ProxyGate (CVE-2026-89103).
Onapsis says ICM2SHELL starts when the kernel reassembles split WebSocket messages. A crafted sequence makes it write past its reserved memory, and Onapsis says it gave SAP a working exploit that runs commands without a login. ProxyGate hinges on the prxyinfo list, meant to admit only trusted networks. Onapsis says that if the list is left open, attackers can send requests that look internal. SAP's own notice names only memory corruption and broken access control. Neither source says attacks are under way.
Both flaws sit in the SAP kernel, and SAP's list shows that kernel behind many other notes, from release 7.22 to 9.21. Onapsis says ProxyGate also reaches out-of-maintenance kernels and gateways beyond ABAP. Patching is therefore a decision about the whole estate. Ask which kernel releases you run, whether the prxyinfo list is open, and which systems are out of maintenance. Trusting a request because it looks internal fails once an attacker can fake that look.