SAP’s Latest Security Patch Release Addresses Critical Vulnerabilities Affecting Thousands of Businesses Worldwide
In a move that is likely to have significant implications for enterprise IT security teams, software giant SAP has released 42 new and updated security notes, including nine critical-severity vulnerabilities. Among the most pressing concerns are two related flaws in the company’s NetWeaver platform, collectively known as ICM2SHELL, which could allow attackers to execute operating system commands with elevated privileges.
At its core, the ICM2SHELL vulnerability stems from a weakness in the SAP kernel component that handles HTTP, HTTPS, and WebSocket traffic. Specifically, it is related to the reassembling of large WebSocket messages, which can be split into fragments during server-browser communication and then reassembled by the receiver. An attacker could exploit this flaw to write malicious data past the end of a memory buffer reserved for connections, potentially leading to a denial-of-service or controlled corruption of system memory.
Onapsis, an enterprise application security firm that has been tracking the issue, warns that ICM2SHELL is not a theoretical outcome. In fact, their researchers have provided SAP with a working exploit that achieves full, unauthenticated remote code execution and can execute arbitrary commands as the
Another critical vulnerability addressed in SAP’s latest patch release is ProxyGate, which affects the company’s Gateway platform. This flaw, tracked as CVE-2026-89103, allows an attacker to bypass access controls and send requests that appear to originate from a trusted network. As a result, an attacker can execute operating system commands with elevated privileges without providing credentials.
It’s worth noting that these vulnerabilities are not isolated incidents but rather part of a broader trend in enterprise software security. SAP’s NetWeaver platform, which is used by thousands of businesses worldwide, has been plagued by critical flaws in recent months. The company’s latest patch release also includes fixes for several high-severity bugs affecting its BusinessObjects and S4CRM platforms.
While SAP’s latest security notes are a step in the right direction, they serve as a reminder that enterprise IT teams must remain vigilant in addressing vulnerabilities and staying up-to-date with the latest patches and updates. As Onapsis notes in their analysis of the patches, this is particularly crucial given the potential for attackers to exploit these flaws without user interaction.
In light of these findings, it’s essential for organizations relying on SAP’s NetWeaver platform to immediately review and apply the relevant security patches to mitigate these risks. This includes ensuring that all necessary updates are installed and configuring access controls to prevent unauthorized requests from external networks. By taking proactive steps to address these vulnerabilities, IT teams can help safeguard their systems against potential attacks and minimize the risk of data breaches or system compromise.
Source: SecurityWeek — 2026-11-10