SAP patches four critical vulnerabilities enabling remote takeover of business systems

SAP's November 2026 security updates include patches for four maximum-severity vulnerabilities in core enterprise software components, collectively tracked as ICM2SHELL and PROXYGATE. These flaws affect NetWeaver Application Server ABAP, SAP Gateway, and SAP Web Dispatcher—key pieces of infrastructure that handle web traffic, external connections, and load balancing in nearly every enterprise SAP environment. Cybersecurity firm Onapsis, which discovered three of the issues, warns that attackers can exploit them remotely without requiring any SAP user credentials or interaction, turning routine web traffic into a direct attack vector.

The impact is severe: successful exploitation grants attackers full control of the underlying SAP system, directly exposing sensitive business data, transaction integrity, and the availability of critical applications like production ERP systems. SAP rated all four vulnerabilities a perfect 10/10 on the CVSS scale, indicating they enable complete remote compromise. This is part of a concerning pattern of maximum-severity flaws in SAP's ecosystem, underscoring the critical need for immediate patching to prevent business-wide disruption and data theft.

What to do: Apply SAP's November 2026 security updates immediately.