SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities
Source SecurityWeek
Mentioned vulnerabilities
Rated Critical by SecurityWeek
Data as of 10 Nov 2026, 15:03 UTC
What to do
AI-suggested
SAP has published official security notes and patches addressing these critical vulnerabilities. Organizations should apply the November 2026 SAP security updates promptly to remediate the ICM2SHELL, ProxyGate, and related critical flaws. Since the vulnerabilities affect the SAP kernel component, patching is essential to prevent unauthenticated remote code execution and system compromise. No alternative mitigations or workarounds are indicated in the vendor advisory.
Description
SAP released 42 new and updated security advisories in November 2026, including nine critical vulnerabilities affecting components such as NetWeaver, Web Dispatcher, and Gateway. Notably, the ICM2SHELL vulnerability allows unauthenticated remote code execution with <sid>adm privileges via crafted WebSocket messages, leading to memory corruption or process crashes. The ProxyGate vulnerability enables unauthenticated attackers to bypass access controls and execute OS commands with high privileges. These kernel-level flaws affect multiple SAP releases, including out-of-maintenance versions, and impact various SAP system types. Additional critical issues include missing authentication bugs that could lead to full system compromise. SAP has published patches addressing these vulnerabilities.