- Description
- SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system.
- Source
- cna@sap.com
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 10
- Impact score
- 6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- cna@sap.com
- CWE-1287
- Hype score
- Not currently trending
SAP fixed four CVSS 10 flaws on Nov 10: ICM2SHELL (CVE-2026-76964, -89126), PROXYGATE (CVE-2026-89103) and CVE-2026-120017. As of Nov 11, no attacks reported. Patch internet-facing Web Dispatcher and ICM first. #SAP 🇬🇧 https://t.co/bDVoMWslXf 🇩🇪 https://t.co/gBkpLKvl
@DIESEC_GmbH
13 Nov 2026
3 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
SAP patches four CVSS 10.0 bugs. All pre-auth. ICM2SHELL and PROXYGATE. CVE-2026-76964 and CVE-2026-89126 : memory corruption in the ICM and Web Dispatcher. RCE on the component that faces the network by design. CVE-2026-89103 "PROXYGATE" : SAP Gateway believes an external
@SaifuddinAmri__
11 Nov 2026
197 Impressions
0 Retweets
3 Likes
2 Bookmarks
0 Replies
0 Quotes
SAPは11月10日、SAP-Security-Patch-Dayで新規のセキュリティノート35件とGitHubのセキュリティアドバイザリ4件を公開し、既発表ノートの更新は3件とした。優先度Criticalは9ノートで、CVSS10.0はCVE-2026-76964（SAP-NetWeaver-AS-A
@MalwareBibleJP
10 Nov 2026
693 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
SAP's November Patch Day brings 35 new notes, including four CVSS 10.0 flaws in NetWeaver: ICM (CVE-2026-76964), Web Dispatcher (CVE-2026-89126), Gateway (CVE-2026-89103) and the ABAP SAML2 provider (CVE-2026-120017). No exploitation reported yet. https://t.co/qEgixgFApn
@CipherSecurityN
10 Nov 2026
46 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Four CVSS 10.0 SAP flaws patched in a single day — ICM2SHELL (CVE-2026-76964 / CVE-2026-89126) enables unauthenticated RCE via malformed WebSocket frames, while PROXYGATE (CVE-2026-89103) lets external attackers impersonate trusted internal application servers. After initial
@aviatrixtrc
10 Nov 2026
58 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 SAP NetWeaver / Web Dispatcher — Kritik Güvenlik Açıkları! — CVE-2026-76964: ICM bellek bozulması / RCE — CVE-2026-89126: Web Dispatcher bellek bozulması / RCE — CVE-2026-89103: SAP Gateway erişim kontrolü açığı — CVE-2026-120017: SAML2 kimlik doğrula
@ridvanyagli
10 Nov 2026
92 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
SAP patched critical unauthenticated RCE flaws ICM2SHELL (CVE-2026-76964) and ProxyGate (CVE-2026-89103), granting attackers sid-adm access on NetWeaver and Gateway. Prioritize kernel updates and lock down https://t.co/AuFfDYj0Fb https://t.co/QC14eBVf0C
@2Workly
10 Nov 2026
6 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
SAP fixed four CVSS 10.0 flaws (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) enabling pre-auth RCE and auth bypass in NetWeaver and Web Dispatcher. Restrict port 33xx now. https://t.co/HCGeiHJZcX https://t.co/QC14eBVf0C #2workly
@2Workly
10 Nov 2026
9 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🆕 New CVE: CVE-2026-76964 (CVSS 10.0, Enclave score 4/10) Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager) Remote, no login needed. SAP NetWeaver Application Server ABAP does not sufficiently validate certain… https://t.co/0gWp3e20g
@EnclaveRadar
10 Nov 2026
25 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes