- Description
- SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness to potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.
- Source
- cna@sap.com
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 10
- Impact score
- 6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Severity
- CRITICAL
- cna@sap.com
- CWE-863
- Hype score
- Not currently trending
SAP fixed four CVSS 10 flaws on Nov 10: ICM2SHELL (CVE-2026-76964, -89126), PROXYGATE (CVE-2026-89103) and CVE-2026-120017. As of Nov 11, no attacks reported. Patch internet-facing Web Dispatcher and ICM first. #SAP 🇬🇧 https://t.co/bDVoMWslXf 🇩🇪 https://t.co/gBkpLKvl
@DIESEC_GmbH
13 Nov 2026
3 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
SAP patches four CVSS 10.0 bugs. All pre-auth. ICM2SHELL and PROXYGATE. CVE-2026-76964 and CVE-2026-89126 : memory corruption in the ICM and Web Dispatcher. RCE on the component that faces the network by design. CVE-2026-89103 "PROXYGATE" : SAP Gateway believes an external
@SaifuddinAmri__
11 Nov 2026
197 Impressions
0 Retweets
3 Likes
2 Bookmarks
0 Replies
0 Quotes
SAP's November Patch Day brings 35 new notes, including four CVSS 10.0 flaws in NetWeaver: ICM (CVE-2026-76964), Web Dispatcher (CVE-2026-89126), Gateway (CVE-2026-89103) and the ABAP SAML2 provider (CVE-2026-120017). No exploitation reported yet. https://t.co/qEgixgFApn
@CipherSecurityN
10 Nov 2026
46 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Four CVSS 10.0 SAP flaws patched in a single day — ICM2SHELL (CVE-2026-76964 / CVE-2026-89126) enables unauthenticated RCE via malformed WebSocket frames, while PROXYGATE (CVE-2026-89103) lets external attackers impersonate trusted internal application servers. After initial
@aviatrixtrc
10 Nov 2026
58 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 SAP NetWeaver / Web Dispatcher — Kritik Güvenlik Açıkları! — CVE-2026-76964: ICM bellek bozulması / RCE — CVE-2026-89126: Web Dispatcher bellek bozulması / RCE — CVE-2026-89103: SAP Gateway erişim kontrolü açığı — CVE-2026-120017: SAML2 kimlik doğrula
@ridvanyagli
10 Nov 2026
92 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
SAP patched critical unauthenticated RCE flaws ICM2SHELL (CVE-2026-76964) and ProxyGate (CVE-2026-89103), granting attackers sid-adm access on NetWeaver and Gateway. Prioritize kernel updates and lock down https://t.co/AuFfDYj0Fb https://t.co/QC14eBVf0C
@2Workly
10 Nov 2026
6 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
SAP fixed four CVSS 10.0 flaws (CVE-2026-76964, CVE-2026-89126, CVE-2026-89103, CVE-2026-120017) enabling pre-auth RCE and auth bypass in NetWeaver and Web Dispatcher. Restrict port 33xx now. https://t.co/HCGeiHJZcX https://t.co/QC14eBVf0C #2workly
@2Workly
10 Nov 2026
9 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🆕 New CVE: CVE-2026-89103 (CVSS 10.0, Enclave score 5/10) Broken Access Control in SAP Gateway Remote, no login needed. SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal… https://t.co/qG2RLaY
@EnclaveRadar
10 Nov 2026
7 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes