SAP has released critical security patches today to address two severe vulnerabilities—PROXYGATE and ICM2SHELL—that could allow attackers to seize control of SAP systems without needing valid login credentials. These issues, discovered and reported by Onapsis Research Labs, represent some of the most dangerous weaknesses SAP has faced this year. Both flaws carry the maximum severity rating, CVSS 10.0.
How PROXYGATE Lets Attackers Impersonate Internal Servers
The PROXYGATE flaw, cataloged as CVE-2026-89103, targets the SAP Gateway component—which mediates communications between SAP systems and external programs. Normally, the Gateway uses access control lists like secinfoand reginfoto ensure requests come from approved servers. But PROXYGATE allows crafted external requests to spoof trusted internal traffic when certain proxy policies are configured permissively. If attackers can trick the gateway, they can issue commands in the context of the
ICM2SHELL Covers Memory Corruption via WebSocket & ICM Handling
The ICM2SHELL vulnerabilities—CVE-2026-76964 (impacting SAP’s Internet Communication Manager) and CVE-2026-89126 (affecting SAP Web Dispatcher and part of SAP HANA XS)—stem from memory corruption in shared kernel code processing WebSocket connections. Because WebSocket support is enabled by default, even systems not explicitly using WebSockets can be at risk. Attackers who reach exposed HTTP or HTTPS ports may exploit these flaws to execute OS-level commands or crash services. Some SAP S/4HANA components accept WebSocket traffic without requiring authentication—widening the attack surface significantly.
Although there’s no evidence yet that either vulnerability has been actively exploited in the wild, organizations can’t afford to wait. Previous breaches involving SAP tools—like the NetWeaver compromise that led to deployment of Auto-Color malware—show how disruptive attacks can be.
What SAP Recommends and How Organizations Should Respond
The SAP advisories outline specific mitigations. For PROXYGATE, patching alone isn’t enough: administrators must set gw/acl_mode_proxy = 1, tighten or disable permissive prxyinforules, and apply updates across all application servers. Older kernel versions that are no longer supported need to be upgraded.
For the ICM2SHELL flaws, SAP has published fixes via Security Notes 3778530 and 3778556. Organizations should prioritize systems using Web Dispatcher and ICM services, ensure the patches are applied even where WebSocket isn’t apparently in use, and verify that all endpoints and services reflect the updated kernel code. Network access to gateways should be restricted to trusted hosts only.
Additional best practices include monitoring logs and alerts for unexpected WebSocket traffic or gateway requests, reviewing configurations against SAP’s proxy policies, and ensuring internal security operations teams have context on these vulnerabilities to speed up detection and response.
Why This Matters:SAP systems are backbone platforms for many large enterprises. Compromise at this level risks entire business workflows, customer data, financial records, and internal trust. In an era where significant business disruption can stem from a single vulnerability, organizations running SAP must treat PROXYGATE and ICM2SHELL as top priorities. Going forward, expect to see intensified focus on securing infrastructure defaults (like WebSocket settings) and more rigorous auditing of proxy and gateway configuration. The real test will be how fast teams can not only patch systems, but also validate that their settings don’t undermine those patches.
