SAP Patches Four Maximum-Severity Flaws in November 2026: What ERP and IT Teams Should Do Now

What Happened

On November 10, 2026, SAP released its monthly security updates, fixing 35 vulnerabilities, including four rated 10 out of 10 on the CVSS scale. SAP says unauthenticated attackers could exploit them remotely to take over affected systems.

According to BleepingComputer, the four issues affect NetWeaver AS ABAP components, SAP Web Dispatcher and SAP Gateway. Security firm Onapsis gave two of the problems the names ICM2SHELL and PROXYGATE. ICM2SHELL combines the ICM and Web Dispatcher memory corruption bugs into a path to remote code execution without any SAP account.

The Hacker News adds the technical detail. The ICM flaw is a heap out-of-bounds write triggered before login by WebSocket control frames with invalid length fields. The Gateway flaw lets an external attacker be treated as one of the system’s own application servers. The SAML2 flaw skips signature checks under certain configurations, so an attacker could sign in as any user on systems that use SAML single sign-on.

Is It Being Exploited?

Neither source reports active exploitation of the four November flaws as of November 10, 2026. However, attackers often reverse-engineer SAP patches quickly, so unauthenticated network flaws of this kind should be treated as urgent even before exploitation is confirmed.

BleepingComputer notes that a maximum-severity SAP Commerce Cloud flaw from August 2026 was flagged as exploited within days of its patch, and that CISA has listed 14 SAP flaws as actively exploited since November 2021. That history is why security teams usually patch SAP internet-facing components first.

Why It Matters for B2B SaaS and ERP Buyers

SAP systems hold finance, supply chain and HR data, and web-facing components such as Web Dispatcher and ICM sit on the network edge. A pre-authentication flaw there can expose an entire ERP landscape, including connected SaaS integrations and stored credentials.

The SAML2 issue also shows the risk of identity integrations. If signature validation fails, single sign-on becomes a path for impersonation. Teams should treat ERP patching, identity configuration and external exposure as one program, not three separate tasks, and should include SAP in vulnerability scanning and asset inventories.

What to Do Now

Apply the four SAP Notes as a priority, update kernels and all Web Dispatchers together, and confirm that gateway and ICM ports are not reachable from user networks or the internet. Where patching is delayed, reduce exposure first and monitor logs closely.

• Inventory every SAP kernel, standalone and embedded Web Dispatcher, and Gateway. The Hacker News notes that a single missed Web Dispatcher leaves the flaw open.
• For the SAML2 flaw, patching is the only fix according to the report. Review trusted identity providers and look for privileged SAML logons from unexpected sources.
• For the Gateway flaw, apply the fix, confirm the gw/acl_mode setting is 1, and verify secinfo and reginfo files contain explicit rules.
• Disabling WebSocket support is described as a temporary mitigation for the ICM and Web Dispatcher issues, but it can break features that rely on it.
• Use your vulnerability scanner and patch tooling to track completion and report to leadership.

SAP Notes are available to customers through the SAP support portal, and the SAP security trust center explains how the company handles disclosures.

Related SaaSPodium Resources

SaaSPodium tracks tools that help IT teams find and close exposures like these. Vulnerability management platforms prioritize risk across assets, while patch management tools automate deployment and reporting, so combining both shortens the time from advisory to fix.

Compare options in our vulnerability management software and patch management software categories, see the guide to vulnerability management tools, and review profiles for Qualys VMDR and Tenable.io. Our walkthrough of automated patch management tools covers deployment automation.

Frequently Asked Questions

Which SAP products are affected by the November 2026 critical flaws?
Reporting names NetWeaver AS ABAP Internet Communication Manager, SAP Web Dispatcher, SAP Gateway and the SAML2 service provider in NetWeaver AS ABAP and ABAP Platform. Check the SAP Notes for exact versions.

Should we patch SAP immediately or wait for a maintenance window?
Treat these as emergency changes where the components are reachable from untrusted networks. Unauthenticated, CVSS 10 flaws justify expedited testing, and temporary exposure reduction while the patch is scheduled.

Do we need new tools to manage SAP vulnerabilities?
Not always. Existing vulnerability scanners and patch tools can track SAP assets if configured, but many teams add SAP-specific monitoring. Evaluate coverage of kernel and application layers before buying.