Report
BleepingComputer: SAP patches four maximum-severity flaws, including ICM2SHELL and PROXYGATE
SAP says four flaws rated 10/10 can let attackers remotely compromise systems without logging in.
TLDR
BleepingComputer reports SAP’s November 2026 updates fix 35 vulnerabilities, including four SAP rated 10/10 across NetWeaver, Web Dispatcher and Gateway. Onapsis says it demonstrated ICM2SHELL with a working exploit that ran operating-system commands without authentication. SecurityWeek reports PROXYGATE can also enable remote code execution when Gateway’s access-control list is left open.
Combined views
—
2 Sources, first seen ago
Comments