SAP on Tuesday issued monthly security patches that include four unauthenticated flaws the vendor scored 10.0 on the CVSS scale, in NetWeaver, Web Dispatcher and Gateway components that sit on many enterprise SAP landscapes^1,2.

The Hacker News said the four bugs need no login and no user action, and that two of them — in the Internet Communication Manager and in Web Dispatcher — can let a network attacker run code¹. BleepingComputer said the November package fixed 35 vulnerabilities in all and that SAP stated unauthenticated attackers can fully compromise targeted systems remotely².

The four identifiers are CVE-2026-76964 in NetWeaver AS ABAP’s ICM, CVE-2026-89126 in SAP Web Dispatcher, CVE-2026-89103 in SAP Gateway, and CVE-2026-120017 in the SAML2 service provider on NetWeaver AS ABAP and ABAP Platform^1,2.

On the ICM and Web Dispatcher pair, The Hacker News said crafted network traffic can corrupt memory and, if successful, allow code execution and full compromise¹. BleepingComputer, citing Onapsis, which it said found three of the four issues, reported that firm tracks those two as ICM2SHELL and the Gateway flaw as PROXYGATE².

Onapsis said ICM2SHELL turns routine web traffic into remote code execution against a network-facing component with no SAP user, password or interaction, according to BleepingComputer². On PROXYGATE, Onapsis said an unauthenticated outsider can be treated as an internal application server and gain the install owner’s control of the SAP system².

The Hacker News described the Gateway issue as a default access-control list enabled with high privileges, so an external attacker can be treated as one of the system’s own application servers¹. On SAML2, it said an attacker could log in as any user, including privileged accounts, on some single sign-on setups, with no workaround listed in the note¹.

SAP’s November bulletin, as summarized by The Hacker News, maps the four to notes 3778530, 3778556, 3798345 and 3849308, with affected kernels spanning several 7.x and 9.x lines and SAP_BASIS releases from 702 through 922 for the SAML issue¹. BleepingComputer did not list those note numbers or version tables².

RedRays, which The Hacker News said reviewed the notes in SAP for Me, advised one kernel and Web Dispatcher rollout covering this month’s related fixes, and described WebSocket disablement as a last-resort block that can break Fiori and ABAP Push Channel features¹. Neither outlet reported confirmed exploitation of these four CVEs^1,2.

BleepingComputer placed the release in a run of other maximum-severity SAP fixes this year and noted CISA has flagged 14 SAP flaws as exploited since November 2021, without tying those listings to Tuesday’s four bugs².