The company addressed memory corruption (CVE-2026-76964) and missing authentication (CVE-2026-120017) flaws in the NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components. NetWeaver is the core app platform that underpins SAP's business software and handles application integration, authentication, user management, and data processing. The other two maximum severity vulnerabilities stem from a broken access control weakness (CVE-2026-89103) in SAP Gateway and a memory corruption issue (CVE-2026-89126) in SAP Web Dispatcher.
Gateway is a core framework that enables external apps to securely connect to SAP backend systems, while Web Dispatcher (deployed in almost every enterprise SAP environment) is a specialized component that acts as a load balancer and reverse proxy for web requests entering an SAP system architecture. Cybersecurity firm Onapsis, which found and reported three of these security issues, collectively tracks CVE-2026-76964 and CVE-2026-89126 as ICM2SHELL and the CVE-2026-89103 pre-auth remote code execution vulnerability as PROXYGATE. "ICM2SHELL turns a routine part of web traffic into a point of ingress for attackers. [..] The result is remote code execution against the component that faces the network by design: no SAP user, no password and no user interaction," Onapsis said.
