Onapsis says SAP's 43 November notes hold four rated 10.0; PROXYGATE's fix is a patch plus a parameter
Onapsis says SAP's November 2026 patch day has 43 notes, four rated CVSS 10.0, and that PROXYGATE's fix on most kernels is a patch plus a parameter that ships off. Onapsis counts 36 vulnerabilities as its own share and BleepingComputer counts 35, and no page read states exploitation.
By Parminder Kumar Sharma · LinkedIn · · 25 min read
Four of SAP's 43 November notes are rated 10.0, and for one Onapsis says a version check is not enough
Onapsis's table of SAP's November 2026 Security Patch Day lists 43 new and updated notes, and four of them are rated CVSS 10.0: 9.3 percent of the notes (derived, 4 of 43). All four sit among the 12 HotNews notes. For one of the four, the Gateway flaw Onapsis calls PROXYGATE, Onapsis says "neither a version check nor patching alone tells you whether you are safe". On most kernel releases, it says, SAP's fix is a kernel patch plus a profile parameter that ships switched off.
That does not establish that anyone is exploiting these flaws: the Onapsis posts say none has been observed as of their publication, and this site found none of the four CVE numbers in CISA's Known Exploited Vulnerabilities list (see the exploitation section). It does not establish how many systems are exposed. It does not establish what SAP's own notes say, because they were not read. SAP's support site robots.txt tells crawlers in general to keep out of the whole site, with exceptions only for some named search engine bots (re-read at about 14:52 UTC on 10 November 2026), so every statement attributed to SAP below reaches the reader through Onapsis, through the CVE records SAP itself published as the numbering authority, or through BleepingComputer.
Onapsis sells SAP security products and calls its platform SAP-endorsed, and its posts say its customers had detection before the patch; the three posts that carry this brief were each published on 10 November 2026 (their page data gives first publication between 11:03 and 11:19 UTC and last update between 12:13 and 12:22 UTC). The lead saved copies at about 12:38 UTC and this site read every one in full between 14:50 and 15:15 UTC on Tuesday 10 November 2026. Anything below described as not observed, not listed or not stated is as of those pages.
This brief sets out what the three Onapsis posts and the four CVE records say about each 10.0 item, why 43, 36 and 35 are three different counts, what the 14 findings credited to a partner AI tool do and do not show, and where the sources differ. This site's October brief on the previous patch day is here; it is not repeated.
The four 10.0 notes: what each is, and what the sources print
Onapsis's patch day post names the four: a memory corruption in the Internet Communication Manager (ICM) and a near twin in the SAP Web Dispatcher, which it dubs ICM2SHELL; a broken access control in the SAP Gateway, which it dubs PROXYGATE; and a missing authentication in the SAML2 Service Provider of the ABAP platform, which it lists without a nickname and without crediting its own team. BleepingComputer says Onapsis "found and reported three of these security issues", which matches: two ICM and Web Dispatcher notes and the Gateway note.
All four CVE records were published by SAP as the numbering authority on 10 November between 00:17 and 00:43 UTC, and all four carry the same score from the same container: CVSS 3.1 base score 10.0 with the vector printed in the Technical details section. The saved records hold only SAP's own container, so every score here is SAP's, not NVD's or CISA's. The records give the discovery source as unknown and do not name Onapsis; the credit comes from Onapsis and BleepingComputer.
What the four SAP CVE records say, as saved on 10 November 2026. Reservation is when the number was set aside, not when the flaw was found.
| Note and CVE | Record title and weakness | Affected, as the record lists | Dates |
|---|---|---|---|
| Note 3778530, CVE-2026-76964 | ICM: memory corruption. CWE-1287: Improper Validation of Specified Type of Input | KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 | Reserved 20 Aug, published 10 Nov at 00:17 UTC. 82 days from reservation (derived) |
| Note 3778556, CVE-2026-89126 | Web Dispatcher: memory corruption. CWE-122: Heap-based Buffer Overflow | HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, KERNEL 7.53, 9.18, 9.20 | Reserved 10 Sep, published 10 Nov at 00:34 UTC. 61 days from reservation (derived) |
| Note 3798345, CVE-2026-89103 | Gateway: broken access control. CWE-863: Incorrect Authorization | KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, 8.04, KERNEL 7.22, 7.54, 7.77, 7.93, 9.16, 9.20, 9.21 | Reserved 10 Sep, published 10 Nov at 00:18 UTC. 61 days from reservation (derived) |
| Note 3849308, CVE-2026-120017 | SAML2 Service Provider: missing authentication. CWE-347: Improper Verification of Cryptographic Signature | SAP_BASIS 702, 731, 740, 750 to 758, 816, 920, 921, 922 (16 listed) | Reserved 30 Oct, published 10 Nov at 00:43 UTC. 11 days from reservation (derived) |
The ICM and Web Dispatcher records are not word for word the same: one names CWE-1287, improper validation of specified type of input, and the other CWE-122, a heap based buffer overflow. Onapsis's patch day post says the Web Dispatcher note "addresses almost the same vulnerability" as the ICM note and points to an SAP FAQ note that explains how the two relate. Neither record mentions WebSocket. The WebSocket detail comes from Onapsis alone.
ICM2SHELL: 'on by default' is Onapsis's claim, and a higher patch level is not always a fixed one
Onapsis says ICM2SHELL is a memory corruption in how the SAP kernel handles WebSocket traffic, in code shared by the ICM and the Web Dispatcher. Its patch day post says some size and length parameters in WebSocket control frames are not properly validated; its deep post says a crafted sequence of WebSocket messages makes the component write past the memory it reserved, in the step where fragmented messages are put back together. It says an attacker needs only network access to the HTTP or HTTPS port, and that the outcome is either a crash or operating system commands as the account that owns the SAP installation. The two descriptions of the mechanism differ in wording (control frames in one, fragment reassembly in the other) and this site does not resolve that.
The default is a claim with an owner. Onapsis writes: "WebSocket support is enabled by default, whether or not it is used", and says a system is exposed even if no application uses WebSocket, and that default ICF services in SAP S/4HANA accept WebSocket connections without authentication. The CVE records say none of this: they describe unvalidated network input in an internal component. Whether SAP's own note states the default in the same words is not known, because it was not read.
On what has and has not been shown: Onapsis says it gave SAP a working exploit for remote code execution without authentication, that the denial of service reproduced on every kernel release it tested, and that it has deliberately left out technical exploitation details. Whether an exploit exists outside Onapsis and SAP is not stated. This site printed nothing beyond what the posts print and did not look for any exploit.
Which kernels: Onapsis says exposure is set by the kernel and covers ABAP systems on kernel 7.40 or higher and every Web Dispatcher, including the one inside SAP HANA XS; AS Java alone is not affected but dual-stack systems are; kernel 7.22 is not. It also lists unmaintained kernels that are affected and may not get a fix. The CVE records list a narrower set (7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20 for the ICM), so the records and Onapsis differ on how far back the problem goes.
Two workarounds are described, and Onapsis says neither replaces the patch. One is a Web Dispatcher at a higher patch level that shields backends reached only through it, which does not work with a particular router setting and does not protect a backend that can be reached directly. The other switches WebSocket support off by parameter and restart, which Onapsis says removes the vulnerability but has a significant impact on interactive and integration scenarios; its patch day post calls this workaround not recommended. It also says "not using WebSocket does not make a system safe": until the patch is applied or the parameter changed, a system that never uses WebSocket stays vulnerable. The parameter and the fixed patch levels are in the Technical details section.
PROXYGATE: the 10.0 depends on a file, a parameter and the kernel
Onapsis says the SAP Gateway uses three access control lists. The first two, secinfo and reginfo, are the ones most security reviews check. The third, prxyinfo, says which connections the gateway may relay or open for a client, and gets far less attention. Onapsis says PROXYGATE "does not depend on a weak secinfo or reginfo", and that a flaw in the gateway's CPI-C layer lets an outside, unauthenticated attacker make the gateway believe a request comes from an internal application server, so that the lists then behave as configured and approve it. It adds that this is a kernel vulnerability, not just an ACL misconfiguration, and that the proxy configuration decides whether it can be exploited.
The CVE record reads more simply than that. SAP's text says the gateway activates a default access control list with high privileges that allows an external attacker to be categorised as an internal application server. Onapsis adds conditions: a restrictive prxyinfo file means the system is not exploitable from untrusted networks; a permissive one means it is vulnerable whatever the kernel patch level; and with no file at all, the outcome turns on the parameter gw/acl_mode_proxy. On that parameter Onapsis says "For backward compatibility, it ships disabled (0), which means allow-all". So the answer to whether the parameter is on by default is no, on Onapsis's account, and SAP's own wording was not read.
What Onapsis says the fix is, by kernel release, in its PROXYGATE post of 10 November 2026. The last column is this site's reading of what the post leaves open.
| Kernel releases | Fix as Onapsis prints it | Left open by the post |
|---|---|---|
| 7.93 and 9.16 | Already support the parameter: setting it to 1 is the fix, with no new kernel required. | The post's first check still applies: a permissive prxyinfo file leaves the system vulnerable whatever the parameter. |
| 7.22, 7.53, 7.54, 7.77 and 8.04 | The kernel patch adds the parameter. Until the patch level is reached the parameter does not exist and the system is vulnerable. Then set it to 1. | The post says the kernel patch alone does not take a system out of scope. |
| 9.20 and 9.21 | A kernel patch; SAP lists no manual activity beyond applying it. | The post also says a kernel patch alone, without a restrictive file or the parameter, does not take a system out of scope. The two statements are not reconciled. |
| 7.20, 7.21, 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85, 7.89 | Out of maintenance and affected: upgrade to a maintained kernel. SAP lists no official workaround. | The CVE record does not list these releases. |
| Any release, no prxyinfo file | Close permissive proxy policies first; create a restrictive file as an interim control where the parameter is not yet supported. | How many gateways in a estate lack the file is something only the owner can answer. |
The practical consequence is the one Onapsis states, and the friendly label it removes: a gateway that was never hardened on this one setting can be exposed without anyone having changed anything. It lists four things that do not take a system out of scope: hardened secinfo and reginfo, SAP authorizations and role design, the application stack on top of the gateway, and applying the kernel patch alone without a restrictive file or the parameter. It also says an SAP Gateway has no reason to be reachable from the internet, directly or through a permissive router route or partner connection.
Counting it: 43 notes, 36 vulnerabilities, 35 vulnerabilities
Three numbers circulate and they are not the same unit. Onapsis counts 43 new and updated notes. Onapsis also says its research team supported SAP in patching 36 vulnerabilities in 24 notes: that is its own share, not SAP's total. BleepingComputer says SAP patched 35 vulnerabilities in its November updates, without saying where the count comes from. No page read gives SAP's own count, because SAP's page was not read.
What each source counts, read 10 November 2026. Rows marked derived are this site's own counts of rows in the Onapsis table.
| Source and figure | What it counts | What it leaves out |
|---|---|---|
| Onapsis headline: 43 | New and updated SAP Security Notes, 12 HotNews and 13 High Priority | Whether SAP counts the same way |
| Onapsis table rows (derived) | 43 rows: 12 HotNews, 13 High, 17 Medium, 1 Low; 35 labelled New and 8 labelled Update | The post's text says two of the notes were published between patch days |
| Onapsis table, CVE ids (derived) | 43 distinct CVE ids printed, but 3 rows print only Multiple CVEs and 1 row prints none | So the id count is a floor, and says nothing about how many vulnerabilities SAP fixed |
| Onapsis text: 36 and 24 | Vulnerabilities and notes its research team says it supported SAP in patching; 7 HotNews and 10 High Priority | SAP's total. The post also says six of twelve HotNews notes in one place and 7 in another |
| Onapsis text: 14 of 36 | Vulnerabilities found in collaboration with XBOW, leading to 7 notes | Method, review and SAP's own view (next section) |
| BleepingComputer: 35 | Vulnerabilities patched in SAP's November 2026 updates | Method and source. It equals the 35 table rows Onapsis labels New (derived); the article does not say it counted that way |
Two details from the Onapsis post bear on the 43. First, it says two HotNews notes were published between the October and November patch days: note 3843368, initially released on 28 October, and note 3846599. Both are labelled New in its table, so not all 35 New rows were released on 10 November. Second, eight rows are labelled Update, among them note 3805589, which the post says was first released on SAP's October patch day. This site does not decide which unit is right. It says that 43 is a count of table rows that includes earlier releases and updates, and that 36 and 35 are counts of something else.
The XBOW claim: what a vendor says about its partner's findings
Onapsis says 14 of the 36 vulnerabilities, leading to 7 notes, were found in collaboration with XBOW. That is 38.9 percent of the 36 and 7 of its 24 notes, 29.2 percent (both derived). It is Onapsis's own statement about its own research work; this site did not read any account from XBOW or from SAP. The wording is collaboration, not credit for a single finder: the post does not say what XBOW is, what part a tool or a person played in each finding, whether Onapsis staff reproduced each one, or whether SAP independently confirmed them. It says nothing about human review of the findings in either direction.
The seven notes the Onapsis post marks as found in collaboration with XBOW, with priority and score from its summary table, read 10 November 2026.
| Note | Priority and CVSS | Title in the summary table |
|---|---|---|
| 3809153 | HotNews, 9.9 | Code injection, NetWeaver Knowledge Management (XML Forms) |
| 3810485 | High, 7.5 | Missing authentication check, NetWeaver AS Java EDM application |
| 3839977 | Medium, 6.5 | Multiple CVEs, NetWeaver AS Java (NWDI Cockpit) |
| 3797108 | Medium, 6.1 | CSS injection, NetWeaver AS Java (Web Dynpro Java) |
| 3835738 | Medium, 5.8 | Server-side request forgery, NetWeaver AS Java (Web Services) |
| 3792447 | Medium, 5.3 | Broken access control, NetWeaver Process Integration (test tool) |
| 3801587 | Medium, 4.3 | Cross site request forgery, NetWeaver Enterprise Portal |
The seven span 4.3 to 9.9, and none of them is one of the four 10.0 notes (derived): the post credits three of the four 10.0 notes to its own team with no mention of XBOW, and does not credit the fourth to Onapsis at all. The seven are 16.3 percent of the 43 (derived). One flag on the post's own tables: its list of eight additional notes prints the same CVE id and the same cross site request forgery title on every row, while its summary table gives different ids and titles for the same note numbers, for example a server-side request forgery for note 3835738. The scores agree between the two tables, so this site used the summary table's titles, and treats the second table as a probable copy error that the post does not acknowledge.
Exploitation: what the pages say, and the KEV check
Both deep posts say that, as of publication, Onapsis has "have not observed active in-the-wild exploitation" of the flaw, will keep watching its threat intelligence network, and will update the post if that changes. The patch day post says it contains ongoing coverage and is updated continuously, and its page data shows an update at 12:13 UTC. BleepingComputer's article, published at 12:07 UTC by its page data, does not state exploitation for any of the four. Its one exploitation statement is about a different flaw, CVE-2026-58231 in Commerce Cloud, which it says Defused flagged as exploited days after an August patch; this site did not read Defused.
This site fetched the CISA Known Exploited Vulnerabilities feed itself at 14:56 UTC on 10 November 2026 (catalogue version 2026.11.09, released 19:54 UTC on 9 November, 1,773 entries). None of CVE-2026-76964, CVE-2026-89126, CVE-2026-89103 or CVE-2026-120017 is in it. The feed holds 14 entries whose vendor is SAP, the same number BleepingComputer cites for flaws flagged since November 2021. A listing can appear at any hour, so this is a reading at 14:56 UTC, not a standing fact.
Labels doing the work of a control
Five comforting labels appear in this story, and in each case the primary says what the label does not cover.
A label, what it suggests, and what the Onapsis posts say, read 10 November 2026.
| Label | What it suggests | What the post says |
|---|---|---|
| Fixed patch level | Any higher number is safe | On 7.93, a higher level is not always a fixed one; patch level 419 is still affected |
| Kernel patched | The gateway is safe | Patching alone does not settle PROXYGATE; the file and the parameter decide, and on most kernels SAP's fix includes the parameter |
| Hardened secinfo and reginfo | The gateway is locked down | These two lists play no part in stopping PROXYGATE; prxyinfo is the one that matters |
| We do not use WebSocket | ICM2SHELL cannot reach us | Not using WebSocket does not make a system safe; it is enabled by default whether or not it is used, per Onapsis |
| CVSS 10.0 | Every system with the component is equally at risk | For PROXYGATE, Onapsis says some configurations make the flaw non-exploitable and others leave it open; the score does not say which yours is |
What the sources state, and what they do not
Stated and not stated across the three Onapsis posts, the four CVE records and the BleepingComputer article, read 10 November 2026.
| Item | Stated, and by whom | Not stated |
|---|---|---|
| SAP's own wording | Relayed by Onapsis and by SAP's CVE records | Any SAP note: not read, because SAP's robots.txt tells crawlers in general to keep out |
| Exploitation | Onapsis: not observed in the wild as of its posts. BleepingComputer: none stated for these four | Any exploitation by anyone; absence from CISA's list at 14:56 UTC is a reading, not a finding |
| A public exploit | Onapsis: it gave SAP a working exploit for ICM2SHELL and a proof of concept for PROXYGATE, and left out technical detail | Whether any exploit is public. This site did not look for one |
| Exposure | Onapsis: ICM and Web Dispatcher are the parts most likely to face the internet, and a gateway should not | How many systems or customers are exposed |
| Versions | Onapsis prints fixed patch levels for ICM2SHELL and minimum patches for PROXYGATE | SAP's per note version lists beyond that, and any fix detail for the SAML2 note |
| The PROXYGATE parameter default | Onapsis: it ships disabled, which means allow-all | SAP's wording; whether every kernel behaves the same |
| The XBOW findings | Onapsis: 14 of 36 vulnerabilities, 7 notes, in collaboration | Method, human review, independent confirmation by SAP |
| The total count | Onapsis: 43 notes, 36 vulnerabilities its share. BleepingComputer: 35 | SAP's own count and how any of these reconcile |
Where the sources differ
The differences are kept as differences. This site has not chosen between them.
Differences between the sources read, 10 November 2026.
| Point | One source | Another source |
|---|---|---|
| How many notes or vulnerabilities | Onapsis table: 43 notes. Onapsis text: 36 vulnerabilities its share | BleepingComputer: 35 vulnerabilities in SAP's November updates |
| HotNews notes Onapsis supported | Onapsis: six of twelve | Onapsis, elsewhere in the same post: 7 tagged as HotNews |
| Eight additional notes | Onapsis second table: one CVE id and one title on all eight rows | Onapsis summary table: different ids and titles for the same notes |
| ICM2SHELL affected kernels | Onapsis: kernel 7.40 or higher, plus unmaintained releases | CVE records: 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20 for the ICM |
| PROXYGATE affected kernels | Onapsis: also 7.20, 7.21, 7.40 to 7.89 and other unmaintained releases | CVE record: 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21 |
| PROXYGATE conditions | CVE record: the default list allows an external attacker to be treated as internal | Onapsis: exploitable only where the proxy policy is open, and some configurations make it non-exploitable |
| PROXYGATE on 9.20 and 9.21 | Onapsis: no manual activity beyond the kernel patch | Onapsis: a kernel patch alone does not take a system out of scope |
| ICM2SHELL mechanism | Onapsis patch day post: size and length parameters in WebSocket control frames | Onapsis deep post: reassembly of fragmented WebSocket messages |
| Which notes are new on 10 November | Onapsis table labels 35 New and 8 Update | Onapsis text: two HotNews notes were published between patch days |
What to do, in order
Items marked Onapsis are its own advice, relayed. Items marked this site's suggestion are not in the posts.
Take this with you
Ordered actions
- Onapsis: build the list of affected systems from kernel release and patch level, including standalone Web Dispatchers, the Web Dispatcher in HANA XS, non production systems that hold production data copies, and unmaintained kernels.
- Onapsis: patch internet facing Web Dispatchers and ICMs first. A compromised Web Dispatcher sits in front of every system it routes to. Then patch production, on every application server and every Web Dispatcher, not only the primary instance.
- Onapsis: where you cannot patch at once, assess the two ICM2SHELL workarounds before applying either, because both can break scenarios in use. Check for status code 101 in the HTTP log to see whether WebSocket is used.
- Onapsis: for each gateway record its prxyinfo state, its gw/acl_mode_proxy value, its kernel and patch level, and which networks can reach the gateway port. Restrict a permissive prxyinfo first, then set the parameter to 1 where the kernel supports it.
- Onapsis: apply the kernel patch for 7.22, 7.53, 7.54, 7.77, 8.04, 9.20 and 9.21, even where a restrictive prxyinfo exists, and upgrade unmaintained kernels.
- Onapsis: narrow network access to the ICM and Web Dispatcher HTTP and HTTPS ports and to the gateway ports, and watch dev_icm and dev_webdisp for unexpected restarts.
- This site's suggestion: read SAP's notes yourself on SAP's support site. This site did not, so the SAML2 note 3849308, whose fix and configuration conditions Onapsis does not print, needs a first hand read by your Basis team.
- This site's suggestion: confirm the kernel patch level and the parameter on each gateway by reading the running profile, not by trusting a version string or a ticket that says patched.
- This site's suggestion: for 7.93 compare each ICM and Web Dispatcher against the exact fixed levels, not against a greater than test.
- This site's suggestion: write down who applies kernel patches in your estate, what downtime they need and by when, because a kernel patch touches every application server.
Technical details
The Onapsis posts and the four CVE records print versions, parameters, rule shapes and note numbers. They print no hash, domain, address, detection rule or query: Onapsis says it will give indicators of compromise to its clients if it sees exploitation, and will update the posts. Everything below is copied as printed, attributed in words, and nothing is added. It leaves out the videos the ICM2SHELL post embeds and any exploit detail, because the posts omit them.
Score and weakness, from the four CVE records. This block is assembled by this site from the record fields, so the layout is derived and the values are as published. A defender can use it to match a scanner finding to a record: the score is SAP's, as the numbering authority.
CVE-2026-76964 CWE-1287 CVSS 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-89126 CWE-122 CVSS 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-89103 CWE-863 CVSS 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-120017 CWE-347 CVSS 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ICM2SHELL fixed patch levels. This is Onapsis's table of the levels that include the fix. Onapsis says to apply the latest available patch for the release, because the listed levels may no longer be downloadable, and that on 7.93 a higher level is not always a fixed one.
Fixed patch levels for ICM2SHELL as printed in the Onapsis ICM2SHELL post of 10 November 2026, read the same day.
| Component | Release | Fixed patch level(s) |
|---|---|---|
| SAP Kernel (Unicode and non-Unicode) and SAP Web Dispatcher | 7.53 | 1616, 1617 |
| SAP Kernel (Unicode and non-Unicode) and SAP Web Dispatcher | 7.54 | 710 |
| SAP Kernel (Unicode) and SAP Web Dispatcher | 7.77 | 914 |
| SAP Kernel (Unicode) and SAP Web Dispatcher | 7.93 | 401, 420 |
| SAP Kernel (Unicode) and SAP Web Dispatcher | 9.16 | 111 |
| SAP Kernel (Unicode) | 9.18 | 37 |
| SAP Kernel (Unicode) | 9.20 | 11, 13 |
| SAP HANA Database 2.0 (WD in XS Classic) | Revisions 079 and 089 | 2.00.079.11, 2.00.089.05 |
| SAP Extended Application Services 1.0 (XS Advanced / XS Runtime 1) | SP05 | Patch 4 |
ICM2SHELL parameter and shield levels. The first block holds the parameter Onapsis says switches WebSocket off, and the router setting with which the shield workaround does not work. The second is the set of Web Dispatcher levels Onapsis says can shield backends reached only through it. A defender checks whether a restart and the loss of WebSocket scenarios are acceptable before using the first.
icm/HTTP/support_websocket_upgrade=FALSE
icm/server_port_<x> = PROT=ROUTER
7.53 PL 1629, 7.54 PL 723, 7.93 PL 430, 9.16 PL 200 or higher
What to hunt for ICM2SHELL. Onapsis says every exploitation attempt is likely to crash the ICM or Web Dispatcher at least once, and names where the restarts are recorded and what to compare. It also says to look for status code 101 in the HTTP log to learn whether WebSocket is used at all. Treat these as names to search for, not as signatures: the post prints no indicator.
dev_icm
dev_webdisp
icman
status code 101
PROXYGATE minimum patch levels. This is Onapsis's table of the minimum kernel patch that contains the fix. It says any higher level contains the fix and that the exact level may no longer be available for download.
Minimum kernel patch levels for PROXYGATE as printed in the Onapsis PROXYGATE post of 10 November 2026, read the same day.
| Kernel version | Build variants | Required minimum patch |
|---|---|---|
| 7.22 EXT, 7.22_EX2, 7.22_EX3 | Unicode and non-Unicode | 1612 |
| 7.53 | Unicode and non-Unicode | 1625 |
| 7.54 | Unicode and non-Unicode | 718 |
| 7.77 | Unicode | 915 |
| 8.04 | Unicode | 244 |
| 9.20 | Unicode | 16 |
| 9.21 | Unicode | 4 |
PROXYGATE parameter and rule shape. The first block is the setting Onapsis says makes the default proxy policy restrictive when no prxyinfo file exists. The second is the shape of a prxyinfo rule and the wildcard example Onapsis gives of a permissive one, which it says leaves a system vulnerable whatever its kernel patch level. A defender searches the gateway's prxyinfo for the second form and for broad sources.
gw/acl_mode_proxy = 1
P SOURCE=<hosts> DEST=<hosts>
P SOURCE=* DEST=*
Note numbers and ports. The numbers Onapsis cites, with the roles this site read from the posts. A defender uses them to find the right note on SAP's support site, which this site did not read.
SAP Security Note #3778530 (CVE-2026-76964, ICM)
SAP Security Note #3778556 (CVE-2026-89126, SAP Web Dispatcher)
FAQ Note #3778788 (ICM2SHELL)
SAP Security Note #3798345 (CVE-2026-89103, SAP Gateway)
FAQ Note #3810197 (PROXYGATE)
SAP Security Note #3849308 (CVE-2026-120017, SAML2 Service Provider)
SAP Security Note #3224889 (gw/acl_mode_proxy)
SAP Security Note #2926224 (secure configuration guidance)
SAP Note #3849055 (Private Cloud Operations FAQ)
Gateway ports 33NN/48NN
What could not be verified
SAP's own notes and the SAP Security Patch Day page were not read, because its robots.txt tells crawlers in general to keep out of the whole site; the CVE records point to SAP's notes on another SAP host, which this site also did not request. XBOW's own account of the findings was not read. The Onapsis posts were read from copies saved by the lead at about 12:38 UTC on 10 November; they are marked as updated until 12:22 UTC and may have changed since. No exploit, proof of concept or video was fetched or searched for. The Onapsis site's robots.txt asks crawlers for a 600 second delay, so this site made no further requests to it.
The question the counts and the parameter leave open
If the count depends on who counts, and a 10.0 can turn on a file and a parameter that ship off, who in your estate can say tonight which of your gateways would answer allow-all, and which of your Web Dispatchers sit at a patch level that only looks high enough?
Key facts
Sources
- PrimarySAP Security Notes: November 2026 Patch Day, published and updated 10 November 2026. Read in full: the 43 note table, the four 10.0 notes, the 36 vulnerabilities and the XBOW claim. Onapsis sells SAP security productsOnapsisaccessed 2026-11-10
- PrimaryICM2SHELL (CVE-2026-76964 and CVE-2026-89126), published and updated 10 November 2026. Read in full: the WebSocket description, fixed patch levels, workarounds and the in the wild statementOnapsisaccessed 2026-11-10
- PrimaryPROXYGATE (CVE-2026-89103), published and updated 10 November 2026. Read in full: the three access control lists, the parameter, the kernel table and the in the wild statementOnapsisaccessed 2026-11-10
- PrimaryOnapsis blog index, read 10 November 2026: lists the three posts dated 11/10/2026 (month first, matching the posts' own Published: November 10, 2026)Onapsisaccessed 2026-11-10
- PrimaryCVE-2026-76964, published 10 November 2026: ICM memory corruption, CWE-1287, CVSS 3.1 base 10.0 by the CNA, affected kernel releasesCVE Program (record by SAP as CNA)accessed 2026-11-10
- PrimaryCVE-2026-89126, published 10 November 2026: Web Dispatcher memory corruption, CWE-122, CVSS 3.1 base 10.0 by the CNACVE Program (record by SAP as CNA)accessed 2026-11-10
- PrimaryCVE-2026-89103, published 10 November 2026: SAP Gateway broken access control, CWE-863, CVSS 3.1 base 10.0 by the CNA, affected kernel releasesCVE Program (record by SAP as CNA)accessed 2026-11-10
- PrimaryCVE-2026-120017, published 10 November 2026: SAML2 Service Provider missing authentication, CWE-347, CVSS 3.1 base 10.0 by the CNA, SAP_BASIS 702 to 922CVE Program (record by SAP as CNA)accessed 2026-11-10
- PrimaryKnown Exploited Vulnerabilities feed, catalogue version 2026.11.09, fetched 14:56 UTC on 10 November 2026: none of the four CVE numbers listed; 14 SAP vendor entries; PHP and Brotli entries for CVE numbers that two SAP notes also coverCISAaccessed 2026-11-10
- Reported bySAP patches ICM2SHELL and PROXYGATE maximum severity flaws, 10 November 2026 (page data 07:07 US Eastern, 12:07 UTC). Secondary: the 35 vulnerabilities count and the earlier maximum severity flaws; used for discovery and the second count onlyBleepingComputeraccessed 2026-11-10
