SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score.

Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server.

The flaws in the Web Dispatcher and the Internet Communication Manager (ICM), which handles the server's web traffic, could allow an attacker who can reach the software over the network to run code, the vendor says.

Kernels that are out of maintenance are affected too, according to Onapsis, an SAP security company whose researchers found the ICM, Web Dispatcher and Gateway flaws.

The company's researchers have not seen the bug exploited in attacks.

The flaw in the server's SAML 2.0 service provider, which hands off user sign-in to an identity provider, could allow an attacker to log in as any user on some systems that use SAML single sign-on.

The flaw in SAP Gateway, which connects the server to other SAP systems and programs, could allow an attacker to impersonate one of the system's own servers and take unauthorized actions.

Each flaw is fixed in its own note, and the affected versions differ by component, according to SAP's November security bulletin; on the affected SAML setups, an attacker could use CVE-2026-120017 to log in as privileged users too, according to the vendor.

Its ICM2SHELL advisory lists kernels 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 for the ICM and Web Dispatcher flaws, and its PROXYGATE advisory lists the same kernels plus 7.20 and 7.21 for the Gateway flaw.

These kernels may not get a fix and need an upgrade to one that is still maintained; a different SAML flaw in the same software, CVE-2026-44748, was fixed on June 9 and needed an attacker with a normal user account.

The notes are in SAP for Me, which requires a sign-in, and the vendor strongly recommends applying them as a priority, and in the ICM flaw (CVE-2026-76964) and the Web Dispatcher flaw (CVE-2026-89126), crafted network traffic could corrupt memory.

Onapsis says both flaws come from one bug, which it calls ICM2SHELL, in kernel code the ICM and Web Dispatcher share for putting split WebSocket messages back together.

The same bug can crash either component, and a crashed Web Dispatcher cuts off every SAP system behind it while it restarts.