SAP rolls out fixes for severe security flaws across core enterprise software

SAP released its November 2026 security updates addressing dozens of vulnerabilities, led by high-impact flaws that pose significant risks to enterprise deployments. Outlets gave differing totals for the release: SecurityWeek noted that SAP published 42 new and updated security advisories, including nine covering critical issues, while BleepingComputer counted 35 patched vulnerabilities, highlighting four maximum-severity vulnerabilities rated 10/10 on the CVSS scale. The critical flaws affect NetWeaver, Web Dispatcher, and Gateway software. [1][2]

Among the most urgent fixes are memory corruption issues tracked as CVE-2026-76964 in the NetWeaver Application Server ABAP Internet Communication Manager and CVE-2026-89126 in SAP Web Dispatcher, which cybersecurity firm Onapsis collectively names ICM2SHELL. A separate broken access control flaw in SAP Gateway, CVE-2026-89103, is tracked as PROXYGATE. SAP warns that unauthenticated attackers can remotely exploit these vulnerabilities to compromise targeted systems completely. According to Onapsis, both weaknesses allow remote attackers to achieve full control without any SAP user account, password, or user interaction. [2]

The fixes come amid persistent targeting of enterprise software environments. The US Cybersecurity and Infrastructure Security Agency has flagged 14 SAP vulnerabilities as actively exploited since November 2021, including three that ransomware groups abused in the wild. The latest patches follow other maximum-severity flaws resolved by SAP in recent months across Commerce Cloud, Kernel code, and Business Technology Platform applications. [2]