DEV Community

Shar z
Shar z

Posted on

SAP's November 2026 Patch Day: ICM2SHELL, PROXYGATE and a SAML Bypass, All Rated CVSS 10.0

#security #cybersecurity #sap #vulnerabilities

SAP's November 2026 Security Patch Day (November 10) fixed four flaws that SAP rates 10.0, the maximum CVSS score. None need a login or any user action. If you run SAP NetWeaver AS ABAP, a Web Dispatcher, or SAP HANA XS, this is a "patch this week" month.

What was fixed

CVE Component SAP Note Impact
CVE-2026-76964 Internet Communication Manager (ICM), NetWeaver AS ABAP 3778530 Pre-auth memory corruption, remote code execution
CVE-2026-89126 SAP Web Dispatcher (incl. HANA XS Classic/Advanced) 3778556 Same bug, same impact, on the edge proxy
CVE-2026-89103 SAP Gateway 3798345 Attacker treated as one of the system's own app servers (PROXYGATE)
CVE-2026-120017 SAML2 service provider, NetWeaver AS ABAP 3849308 Log in as any user on some SAML SSO setups

ICM2SHELL (CVE-2026-76964 / CVE-2026-89126)

Onapsis Research Labs found that the kernel code shared by the ICM and the Web Dispatcher mishandles reassembly of fragmented WebSocket messages. A crafted sequence writes attacker-controlled data past the end of the buffer. Onapsis gave SAP a working exploit that runs OS commands as <sid>adm, the account that owns the SAP installation, and says a single connection crashed the process on every kernel release tested.

Why it matters: WebSocket support is on by default whether or not anything uses it, and some default S/4HANA ICF services accept WebSocket connections without authentication. The Web Dispatcher, the component usually facing the internet, reassembles messages itself, so the shield is exposed first. Exposure depends on the kernel, not the application release: AS ABAP on kernel 7.40+ and any Web Dispatcher. AS Java is not affected (dual-stack is). Out-of-maintenance kernels (7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85, 7.89) are affected and may not get a fix. Onapsis has not seen in-the-wild exploitation.

Watch out on 7.93: per Onapsis, PL 419 is still vulnerable; only the updated PL 401 Stack Kernel, PL 402 (once released) and PL 420+ are fixed.

PROXYGATE (CVE-2026-89103)

SAP Gateway ships its default proxy access list with high privileges. Per the researchers, exposure is decided by the proxy list prxyinfo (or, when it's missing, the profile parameter gw/acl_mode_proxy, which ships as 0 and allows every proxy connection), not by the secinfo/reginfo lists most hardening guides cover. The kernel patch alone doesn't take a system out of scope without a restrictive prxyinfo or gw/acl_mode_proxy = 1.

SAML2 bypass (CVE-2026-120017)

Under certain configurations, the AS ABAP SAML2 service provider didn't verify signatures on incoming assertions, letting an attacker log in as any user, privileged ones included. There's no workaround; apply the note or support package.

What to do now

  1. Inventory every Web Dispatcher and ICM, including standalone WDs, those embedded in HANA XS, non-production copies, and legacy kernels. One missed instance leaves the hole open.
  2. Patch internet-facing Web Dispatchers first. Fixed levels per Onapsis: 7.53 PL 1616/1617, 7.54 PL 710, 7.77 PL 914, 7.93 PL 401 (updated stack)/420, 9.16 PL 111, 9.18 PL 37, 9.20 PL 11/13; HANA 2.00.079.11 / 2.00.089.05; XS Advanced SP05 Patch 4.
  3. If you can't patch today: a WD on 7.53 PL 1629, 7.54 PL 723, 7.93 PL 430 or 9.16 PL 200+ can shield backends reached only through it (not with PROT=ROUTER). As a last resort, icm/HTTP/support_websocket_upgrade=FALSE removes the bug but breaks WebSocket features; check the ICM/WD HTTP log for status 101 first.
  4. Gateway: restrict prxyinfo, set gw/acl_mode_proxy = 1, and limit gateway ports 33NN/48NN to hosts that need RFC.
  5. SAML2: treat any AS ABAP using SAML2 browser logon (Fiori Launchpad, Web GUI behind an IdP) as in scope; review trusted IdPs in transaction SAML2 and audit privileged SAML logons from unexpected sources.
  6. Detect: exploitation attempts will likely crash the ICM/WD. Investigate unexpected restarts in dev_icm / dev_webdisp and icman PID changes outside maintenance windows.

Sources

Shar Z, Security Engineer at Nine-Security

繁體中文版

SAP 於 2026 年 11 月 10 日的安全修補日（Security Patch Day）修補了四個 CVSS 10.0（滿分）的漏洞，全部不需登入、也不需使用者互動。只要環境裡有 SAP NetWeaver AS ABAP、Web Dispatcher 或 SAP HANA XS，這個月請排進「本週必修」。

修補了什麼

CVE 元件 SAP Note 影響
CVE-2026-76964 NetWeaver AS ABAP 的 ICM（Internet Communication Manager） 3778530 未驗證記憶體破壞，可遠端執行程式碼
CVE-2026-89126 SAP Web Dispatcher（含 HANA XS Classic/Advanced 內嵌） 3778556 同一個 bug，出現在對外的反向代理上
CVE-2026-89103 SAP Gateway 3798345 攻擊者被當成系統自己的應用伺服器（PROXYGATE）
CVE-2026-120017 NetWeaver AS ABAP 的 SAML2 服務提供者 3849308 部分 SAML SSO 設定下可冒用任何使用者登入

ICM2SHELL（CVE-2026-76964 / CVE-2026-89126）

Onapsis Research Labs 發現，ICM 與 Web Dispatcher 共用的核心（kernel）程式碼在重組分段 WebSocket 訊息時有缺陷，特製的訊息序列會把攻擊者控制的資料寫出緩衝區範圍。Onapsis 已提供 SAP 可用的 exploit，能以 <sid>adm（擁有整套 SAP 安裝的帳號）身分執行作業系統指令；在所有測試過的 kernel 版本上，單一連線就能讓程序當掉。

為什麼嚴重：WebSocket 支援預設開啟，不管有沒有用到；部分 S/4HANA 預設 ICF 服務甚至接受未驗證的 WebSocket 連線。通常面向網際網路的 Web Dispatcher 會自己重組訊息，等於「防護層」最先中招。影響範圍由 kernel 決定而非應用版本：kernel 7.40 以上的 AS ABAP 與所有 Web Dispatcher。AS Java 不受影響（dual-stack 受影響）。已停止維護的 kernel（7.40、7.41、7.42、7.45、7.49、7.73、7.81、7.85、7.89）同樣受影響且可能不會有修補。Onapsis 表示目前未觀察到在野利用。

7.93 要特別注意：依 Onapsis，PL 419 仍有漏洞，只有更新後的 PL 401 Stack Kernel、PL 402（釋出後）以及 PL 420 以上才有修正。

PROXYGATE（CVE-2026-89103）

SAP Gateway 預設的 proxy 存取清單權限過高。研究人員指出，是否暴露取決於 proxy 清單 prxyinfo（若不存在，則由設定檔參數 gw/acl_mode_proxy 決定，出廠值為 0，允許所有 proxy 連線），而不是多數強化指南關注的 secinfo/reginfo。只打 kernel patch、沒有限縮 prxyinfo 或把 gw/acl_mode_proxy 設為 1，系統仍在風險範圍內。

SAML2 繞過（CVE-2026-120017）

在特定設定下，AS ABAP 的 SAML2 服務提供者沒有驗證傳入 assertion 的簽章，攻擊者可冒用任何使用者（包含高權限帳號）登入。沒有暫時緩解方式，只能套用 note 或 support package。

現在該做什麼

  1. 盤點所有 Web Dispatcher 與 ICM：包含獨立 WD、HANA XS 內嵌 WD、非正式環境的資料副本、老舊 kernel。漏掉一台就等於門沒關。
  2. 先修對外的 Web Dispatcher。 Onapsis 列出的修正版本：7.53 PL 1616/1617、7.54 PL 710、7.77 PL 914、7.93 PL 401（更新版 stack）/420、9.16 PL 111、9.18 PL 37、9.20 PL 11/13；HANA 2.00.079.11 / 2.00.089.05；XS Advanced SP05 Patch 4。
  3. 今天無法修補時：升到 7.53 PL 1629、7.54 PL 723、7.93 PL 430 或 9.16 PL 200 以上的 WD，可保護「只能」經由它存取的後端（PROT=ROUTER 模式無效）。最後手段是設定 icm/HTTP/support_websocket_upgrade=FALSE，可移除漏洞但會影響 WebSocket 功能；先查 ICM/WD HTTP log 有沒有狀態碼 101 的請求。
  4. Gateway：限縮 prxyinfo、將 gw/acl_mode_proxy 設為 1，並把 gateway 埠 33NN/48NN 限制在真正需要 RFC 的主機。
  5. SAML2：凡是用 SAML2 做瀏覽器登入的 AS ABAP（Fiori Launchpad、IdP 後的 Web GUI）一律視為受影響；在交易碼 SAML2 檢查所有受信任的 IdP，並稽核來源異常的高權限 SAML 登入。
  6. 偵測：利用嘗試多半會讓 ICM/WD 當掉。留意 dev_icm／dev_webdisp 中非預期的重啟，以及維護窗口外 icman PID 的變化。

參考來源

Shar Z，Nine-Security 資安工程師

Top comments (0)