Inside SAP's Four CVSS 10.0 Flaws: Technical Dissection of ICM2SHELL, PROXYGATE, and SAML Authentication Bypass

Executive Summary

On November 10, 2026, SAP released its monthly Security Patch Day advisory, delivering 35 new SAP Security Notes, four GitHub advisories, and three updates to prior bulletins. Among the 42 total items addressed, nine issues were designated Critical. Most critically, four independent vulnerabilities achieved the maximum possible CVSS v3.1 base score of 10.0. Each flaw presents an identical maximum severity vector: network-accessible (AV:N), low attack complexity (AC:L), zero privileges required (PR:N), zero user interaction required (UI:N), changed scope (S:C), and total impact across confidentiality, integrity, and availability (C:H/I:H/A:H).

The four maximum-severity flaws reside in the core networking and authentication layers of the SAP NetWeaver application server ecosystem:

1. SAP Security Note #3778530 (CVE-2026-76964): An unauthenticated heap memory corruption vulnerability in the Internet Communication Manager (ICM) of SAP NetWeaver AS ABAP, enabling pre-authentication remote code execution (RCE) at the operating system level.
2. SAP Security Note #3778556 (CVE-2026-89126): A twin heap memory corruption flaw in SAP Web Dispatcher—the HTTP/HTTPS reverse proxy deployed at network perimeters and embedded within SAP HANA XS Classic and XS Advanced.
3. SAP Security Note #3798345 (CVE-2026-89103): A critical broken access control vulnerability in the SAP Gateway CPI-C communication subsystem, named PROXYGATE, allowing external network attackers to impersonate trusted internal application servers and trigger arbitrary OS commands.
4. SAP Security Note #3849308 (CVE-2026-120017): A cryptographic authentication bypass in the SAML 2.0 service provider implementation across SAP NetWeaver AS ABAP and ABAP Platform, stemming from missing signature validation on incoming SAML assertions.

Because ICM, Web Dispatcher, and SAP Gateway terminate ingress traffic from enterprise extranets, unpatched landscapes face immediate zero-click takeover. Immediate mitigation requires native kernel-level binary replacement, gateway access control list auditing, and strict verification of cryptographic assertion policies.

---

Technical Mechanics and Architecture

SAP NetWeaver AS ABAP instances rely on specialized native C/C++ kernel daemons that manage multi-protocol networking, memory pooling, and inter-system Remote Function Calls (RFC).

+-------------------------------------------------------------------------------+
|                         UNTRUSTED EXTERNAL NETWORK                            |
+-------------------------------------------------------------------------------+
         |                                             |
         | [1] Ingress HTTP / WebSocket               | [2] Direct RFC / CPI-C
         |     (Ports 80/443/8000/8443)                |     (Ports 3300-3399)
         v                                             v
+-------------------------------+             +---------------------------------+
|      SAP Web Dispatcher       |             |           SAP Gateway           |
|      (CVE-2026-89126)         |             |        (CVE-2026-89103)         |
|  * Edge Reverse Proxy / WAF   |             |  * PROXYGATE ACL Impersonation  |
|  * WebSocket Heap Corruption  |             |  * secinfo / reginfo Bypass     |
+-------------------------------+             +---------------------------------+
         |                                                     |
         | Internal HTTP/WebSocket                             | Trusted RFC Request
         v                                                     v
+-------------------------------+             +---------------------------------+
| Internet Communication Manager|             |    SAP Work Processes (ABAP)    |
|      (ICM: CVE-2026-76964)    |             |  * Dialog, Batch, Spool         |
|  * Shared Kernel C/C++ Stack  |             |  * Executes RFC Function Modules|
|  * ICM2SHELL Heap Overflow    |             +---------------------------------+
+-------------------------------+                              ^
         |                                                     |
         | In-Memory Session Hand-off                          |
         v                                                     |
+-------------------------------+                              |
| SAML 2.0 Service Provider     |------------------------------+
|      (CVE-2026-120017)        |  Bypassed Assertion Signature:
|  * Assertion Signature Failure|  Claims Identity (e.g., DDIC, SAP*)
+-------------------------------+

1. ICM2SHELL: Heap Memory Corruption in ICM and Web Dispatcher (CVE-2026-76964 & CVE-2026-89126)

The Internet Communication Manager (icman/icmbnd) terminates HTTP, HTTPS, and WebSocket connections for the SAP application server, while SAP Web Dispatcher (sapwebdisp) serves as the edge reverse proxy. Both components share a common C/C++ networking codebase. Researchers at Onapsis identified that both harbor an identical heap corruption flaw within their shared WebSocket frame reassembly subroutines.

When a client initiates an HTTP protocol upgrade (Upgrade: websocket), the ICM allocates frame buffers from its global memory pool (MPI). During WebSocket communication, data is transmitted in discrete frames containing header flags, masking keys, and payload length descriptors. Under CVE-2026-76964 and CVE-2026-89126, a logic flaw in payload length calculation causes memory allocation to under-allocate required heap space when processing fragmented extended-length frames. The subsequent network copy routine writes attacker-supplied payload bytes past the allocated heap boundary (CWE-122).

Because this memory corruption occurs during initial network framing before authentication or session setup, no credentials or valid session tokens are needed. An unauthenticated attacker transmitting malformed WebSocket frames can hijack execution flow. Because ICM executes with the operating system privileges of <sid>adm, successful exploitation yields immediate host command execution.

2. PROXYGATE: Broken Access Control in SAP Gateway (CVE-2026-89103)

The SAP Gateway daemon (gwrd) manages RFC communications across CPI-C network protocols over TCP ports 33<instance> and 48<instance>. To protect administrative RFC functions and external server registrations, SAP Gateway enforces access control lists defined in secinfo (external program execution) and reginfo (external program registration).

Dubbed PROXYGATE by Onapsis, CVE-2026-89103 represents an authorization bypass within Gateway connection handling (CWE-863). When an external RFC client establishes a CPI-C connection, it supplies connection metadata. A remote attacker can craft transport flags that trick the gateway into treating the connection as originating from a local application server within the same SAP System ID (SID). Under standard configurations with default or wildcard ACLs, internal application servers are implicitly trusted. This spoofing allows attackers to bypass secinfo filters, invoke sensitive RFC modules such as RFC_START_PROGRAM, and execute arbitrary OS commands as <sid>adm.

3. SAML 2.0 Assertion Signature Bypass (CVE-2026-120017)

Enterprise SAP landscapes use SAML 2.0 Web Single Sign-On to authenticate users accessing Fiori Launchpads and Web GUI endpoints via central Identity Providers. In a compliant SAML flow, the Identity Provider issues a cryptographically signed XML assertion confirming user identity.

Under CVE-2026-120017 (SAP Note #3849308, CWE-347), the SAML 2.0 service provider in AS ABAP fails to enforce mandatory signature verification on incoming assertions under certain configurations. An unauthenticated remote attacker can submit a forged assertion declaring arbitrary NameID values (such as DDIC or SAP*). The SAP system accepts the assertion without validating the cryptographic signature, granting immediate superuser access across the business suite.

---

Defensive Inspection and Verification Script

The following defensive Python script inspects local gateway access control rules for unsafe wildcards and checks whether target ICM endpoints accept WebSocket upgrade handshakes.

# defensive_sap_audit.py
# Audits local SAP Gateway ACL configuration files and tests
# ICM/Web Dispatcher HTTP endpoints for WebSocket protocol availability.
# Requires: python3, standard library

import os
import sys
import re
import urllib.request
import ssl

def audit_gateway_acls(secinfo_path, reginfo_path):
    print("[*] Auditing SAP Gateway Access Control Lists...")
    wildcard_pattern = re.compile(r'^\s*(P|D)\s+.*\b(USER=\*|HOST=\*|TP=\*)\b', re.IGNORECASE)
    for acl_name, path in [("secinfo", secinfo_path), ("reginfo", reginfo_path)]:
        if not os.path.isfile(path):
            print(f"[-] Warning: {acl_name} file not found at {path}")
            continue
        print(f"[+] Inspecting {acl_name}: {path}")
        with open(path, "r", encoding="utf-8", errors="ignore") as f:
            for line_no, line in enumerate(f, 1):
                clean_line = line.strip()
                if clean_line and not clean_line.startswith("#") and wildcard_pattern.search(clean_line):
                    print(f"    [!] Permissive Wildcard on Line {line_no}: {clean_line}")

def test_websocket_exposure(host, port, ssl_enabled=True):
    print(f"[*] Testing WebSocket endpoint exposure on {host}:{port}...")
    protocol = "https" if ssl_enabled else "http"
    target_url = f"{protocol}://{host}:{port}/sap/bc/bsp/sap/system/test.htm"
    headers = {
        "User-Agent": "DefensiveSecAudit/1.0",
        "Connection": "Upgrade",
        "Upgrade": "websocket",
        "Sec-WebSocket-Version": "13",
        "Sec-WebSocket-Key": "dGhlIHNhbXBsZSBub25jZQ=="
    }
    req = urllib.request.Request(target_url, headers=headers)
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    try:
        with urllib.request.urlopen(req, timeout=5, context=ctx if ssl_enabled else None) as resp:
            print(f"[+] Endpoint response code: {resp.status}")
            if resp.status == 101:
                print("[!] ALERT: Endpoint accepted WebSocket upgrade request.")
    except urllib.error.HTTPError as e:
        print(f"[+] Server returned HTTP status {e.code} (Safe: Not a WebSocket 101 switch)")
    except Exception as e:
        print(f"[-] Connection failed or refused: {e}")

if __name__ == "__main__":
    if len(sys.argv) > 2:
        test_websocket_exposure(sys.argv[1], int(sys.argv[2]))
    else:
        audit_gateway_acls("/usr/sap/trans/bin/secinfo", "/usr/sap/trans/bin/reginfo")

---

Vulnerability Evidence and Threat Exposure

The attack surface presented by these four flaws spans tens of thousands of enterprise deployments worldwide.

Ingress Exposure and Internet Reachability

While internal RFC ports (TCP 3300-3399) are typically restricted behind firewalls, Web Dispatcher instances and ICM listeners (TCP 80, 443, 8000, 8443) are frequently exposed to corporate extranets and the internet to support Fiori mobile apps, supplier portals, and B2B web services. Any exposed endpoint supporting WebSocket upgrades is vulnerable to ICM2SHELL. Because memory corruption occurs within the native C/C++ kernel allocator, standard HTTP-level WAF rules fail to inspect malformed binary WebSocket frames post-upgrade.

Operational Blast Radius and Compliance Impact

Because the ICM, Web Dispatcher, and Gateway processes execute as the <sid>adm system account, successful exploitation provides operating system access to database credentials, SAP Secure Store keys (SSFS), and database tools (hdbsql). From <sid>adm, attackers can pivot across internal networks via trusted RFC destinations (SM59).

Unpatched systems face immediate compliance violations under international standards:

• PCI DSS 4.0 (Requirement 6.3.3): Requires emergency patching of critical vulnerabilities affecting cardholder data environments.
• DORA (Articles 9 & 10): Mandates ICT risk management and rapid vulnerability remediation across EU financial entities.
• NIS2 Directive (Article 21): Enforces supply chain cybersecurity and vulnerability mitigation.
• NYDFS 23 NYCRR 500 (Section 500.7): Mandates strict privilege controls and mitigation of edge application defects.

---

Enterprise Hardening Playbook

Remediation requires a multi-phase operational workflow. Because ICM2SHELL and PROXYGATE affect native binaries, ABAP SNOTE transports cannot resolve them; full SAP kernel package replacement is required.

Phase 1: Immediate Perimeter Shielding

1. Restrict RFC Ports: Block TCP ports 3300-3399 and 4800-4899 on external firewalls, allowing access only from authorized application servers.
2. Disable WebSocket Upgrades: If WebSocket is not required, disable it in ICM by setting icm/HTTP/support_websocket = FALSE in DEFAULT.PFL. Alternatively, configure reverse proxies (NGINX, AWS ALB) to strip Upgrade: websocket headers.

Phase 2: Kernel Replacement (SAP Notes #3778530 & #3778556)

Deploy updated SAP Kernel packages (SAPEXE.SAR and SAPEXEDB.SAR) and standalone Web Dispatcher archives (SAPWEBDISP.SAR):

# 1. Stop SAP Instance
stopsap R3 <instance_number>

# 2. Backup existing kernel directory
cp -pr /sapmnt/<SID>/exe /sapmnt/<SID>/exe_backup_$(date +%F)

# 3. Extract updated kernel archives using SAPCAR
SAPCAR -xvf /tmp/patches/SAPEXE_<patch_level>.SAR -R /sapmnt/<SID>/exe
SAPCAR -xvf /tmp/patches/SAPEXEDB_<patch_level>.SAR -R /sapmnt/<SID>/exe

# 4. Verify setuid permissions on helper binaries
cd /sapmnt/<SID>/exe
chown root:sapsys icmbnd sapuxuserchk
chmod 4755 icmbnd sapuxuserchk

# 5. Restart SAP Instance
startsap R3 <instance_number>

Phase 3: Gateway ACL Hardening (SAP Note #3798345)

Enforce strict gateway security parameters in DEFAULT.PFL:

# Enforce strict ACL checking for starting and registering programs
gw/acl_mode = 1

# Prevent clients from forwarding connection information without verification
gw/reg_no_conn_info = 1

# Enable security logging for rejected RFC connections
gw/logging = ACTION=ACTNX

Replace permissive entries in /usr/sap/<SID>/SYS/global/secinfo:

P USER=adm HOST=localhost TP=*
D USER=* HOST=* TP=*

And in /usr/sap/<SID>/SYS/global/reginfo:

P TP=RFC_COMM_PROG HOST=10.10.*.* ACCESS=10.10.*.* CANCEL=10.10.*.*
D TP=* HOST=* ACCESS=* CANCEL=*

Reload ACLs dynamically via SAP GUI transaction SMGW (Goto -> Expert Functions -> External Security -> Reread).

Phase 4: SAML 2.0 Hardening (SAP Note #3849308)

1. Open transaction SAML2 in SAP GUI.
2. Navigate to Local Provider -> Service Provider Settings.
3. Under Signature and Encryption, set Digest Algorithm to SHA-256, set Verify Assertion Signature to Always, and set Verify Response Signature to Always.
4. Apply the automated correction instructions from SAP Note #3849308.

Phase 5: Network Intrusion Detection Signatures

Deploy Suricata network inspection rules across boundary and core inspection points:

# Detect Malformed WebSocket Length Overflows targeting SAP ICM
alert tcp $EXTERNAL_NET any -> $SAP_HTTP_SERVERS [80,443,8000,8443] (
    msg:"CODEBUMBLE - SAP NetWeaver ICM2SHELL WebSocket Exploit Attempt";
    flow:to_server,established;
    content:"Upgrade: websocket"; http_header; nocase;
    content:"|82 7f|"; depth:2; offset:0;
    byte_test:8,>,0x7fffffffffffffff,2;
    reference:cve,2026-76964;
    reference:url,support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html;
    classtype:attempted-admin;
    sid:202611101;
    rev:1;
)

# Detect Unauthorized RFC Gateway Program Registration (PROXYGATE)
alert tcp $EXTERNAL_NET any -> $SAP_GATEWAY_SERVERS [3300:3399] (
    msg:"CODEBUMBLE - Unauthorized SAP Gateway External Program Registration (PROXYGATE)";
    flow:to_server,established;
    content:"NI_PONG"; depth:20;
    content:"TP="; distance:0;
    reference:cve,2026-89103;
    reference:url,support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html;
    classtype:policy-violation;
    sid:202611102;
    rev:1;
)

---

Frequently Asked Questions (FAQ)

What makes the November 2026 SAP patches unprecedented compared to previous cycles?

Monthly SAP patch days typically feature one or two critical vulnerabilities. The November 2026 cycle released four independent vulnerabilities that each scored a maximum CVSS 10.0. All four require zero authentication, have low attack complexity, require zero user interaction, and target components exposed to the network perimeter (ICM, Web Dispatcher, Gateway, and SAML2).

Can ICM2SHELL or PROXYGATE be resolved via standard ABAP SNOTE transports?

No. Standard SAP Notes using the SNOTE transaction deploy ABAP corrections. However, ICM2SHELL (CVE-2026-76964 and CVE-2026-89126) and PROXYGATE (CVE-2026-89103) reside within compiled native C/C++ kernel binaries (icman, sapwebdisp, and gwrd). Remediation requires deploying replacement kernel archives (SAPEXE and SAPEXEDB) and restarting instances.

Does a standalone Web Dispatcher in the DMZ protect backend NetWeaver systems from ICM2SHELL?

No. Standalone SAP Web Dispatcher instances share the exact same vulnerable kernel communication codebase as ICM. If deployed in the DMZ, an unauthenticated attacker can exploit CVE-2026-89126 directly against the Web Dispatcher to compromise the DMZ host. Additionally, if the Web Dispatcher proxies WebSocket traffic transparently, the malformed payload passes directly to the backend ICM.

What temporary mitigations exist if maintenance windows prevent immediate kernel updates?

Administrators should:

1. Restrict Gateway RFC ports (TCP 3300-3399) to trusted internal application servers.
2. Strip or reject HTTP requests containing Upgrade: websocket at external reverse proxies.
3. Set icm/HTTP/support_websocket = FALSE in SAP instance profiles to disable WebSocket processing in ICM.

How does PROXYGATE (CVE-2026-89103) bypass network perimeter firewalls?

PROXYGATE exploits connection logic rather than circumventing network packet filters. If an organization exposes RFC ports for B2B electronic data interchange, the firewall permits TCP port 3300 traffic. Once connected, PROXYGATE manipulates connection origin headers, causing the Gateway software to classify the request as trusted internal application traffic and bypassing internal secinfo and reginfo access controls.

---

Intelligence Sources and References

1. SAP Support Portal (November 10, 2026): SAP Security Patch Day – November 2026 — Comprehensive vendor bulletin documenting 35 new security notes, nine critical vulnerabilities, and four CVSS 10.0 advisories.
   https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
2. CVE Record (November 10, 2026): CVE-2026-76964 & CVE-2026-89126: Memory Corruption in SAP NetWeaver AS ABAP ICM and SAP Web Dispatcher — Official CVE program technical descriptions and CVSS metrics.
   https://www.cve.org/CVERecord?id=CVE-2026-76964
3. Onapsis Threat Advisory (November 10, 2026): ICM2SHELL (CVE-2026-76964, CVE-2026-89126) and PROXYGATE (CVE-2026-89103): Critical Pre-Authentication Vulnerabilities in SAP NetWeaver — Technical deep dive into heap buffer overflows and Gateway access control logic flaws.
   https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/
4. Beazley Security Labs Advisory BSL-A1244 (November 12, 2026): Critical Vulnerabilities in SAP NetWeaver, Web Dispatcher, and Gateway — Enterprise risk assessment, SAML2 signature validation analysis, and incident response triage guidance.
   https://labs.beazley.security/advisories/BSL-A1244
5. Aviatrix Threat Research Center (November 11, 2026): SAP CVSS 10.0 Flaws 2026: ICM2SHELL & PROXYGATE Technical Architecture Analysis — Perimeter attack surface exposure mapping, regulatory impact analysis (PCI DSS, DORA, NIS2), and zero trust mitigation.
   https://aviatrix.ai/threat-research-center/sap-patches-four-cvss-100-flaws-2026-rce-icm2shell-proxygate/