The important distinction: these are weaknesses in communications and authentication infrastructure, not merely an optional business application. BleepingComputer reports that exploitation can allow remote compromise without credentials or user interaction.
Four critical flaws, four remediation notes
SAP’s public bulletin maps the vulnerabilities to these security notes:
| Vulnerability | Affected component | Weakness | SAP Note |
|---|---|---|---|
| CVE-2026-76964 | NetWeaver AS ABAP Internet Communication Manager | Memory corruption | 3778530 |
| CVE-2026-89126 | SAP Web Dispatcher | Memory corruption | 3778556 |
| CVE-2026-89103 | SAP Gateway | Broken access control | 3798345 |
| CVE-2026-120017 | NetWeaver AS ABAP and ABAP Platform SAML2 Service Provider | Missing authentication | 3849308 |
BleepingComputer attributes discovery of three flaws to Onapsis. ICM2SHELL covers the ICM and Web Dispatcher vulnerabilities; PROXYGATE identifies the Gateway flaw. These are research names, not additional vulnerabilities to count separately.
According to Onapsis’s explanation quoted by BleepingComputer, ICM2SHELL enables unauthenticated remote code execution through network-facing communications components. PROXYGATE instead allows an external attacker to be treated as an internal application server, potentially achieving control under the account that owns the SAP installation. The SAML2 authentication flaw is the fourth maximum-severity issue, separate from those two research labels.
Version checks matter more than product names
SAP’s affected-product list reaches beyond a standalone Web Dispatcher installation: its corresponding note also names HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1 and several kernel families. The SAML2 issue lists SAP_BASIS 702, 731, 740, 750–758, 816 and 920–922.
The practical implication: do not limit discovery to machines whose inventory label says “Web Dispatcher.” Match installed components and release levels against each applicable note. The public bulletin identifies affected releases; it should not be mistaken for a list of fixed patch levels.
A practical response for enterprise IT
The following is an operational prioritization approach, rather than a vendor-provided installation procedure:
- Create four separate remediation records. Track each CVE and note independently so that fixing one component does not accidentally close the entire investigation.
- Map components to systems and owners. Include production, disaster-recovery and non-production environments in the review.
- Prioritize by reachability and business impact. Start with affected services reachable from untrusted networks, then work inward rather than treating internal placement as proof of safety.
- Use the applicable SAP note for implementation. Confirm prerequisites, replacement packages, configuration requirements and restart instructions before scheduling changes.
- Verify completion. Record the installed correction level and test communications, authentication and business workflows after the change.
For each system, a useful completion record should answer three questions: Was it affected? Which correction was applied? What evidence confirms that remediation succeeded? A downloaded patch is not a finished change.
Urgent does not mean confirmed exploitation
Neither SAP’s public patch-day summary nor BleepingComputer’s report establishes active exploitation of these four newly disclosed vulnerabilities. The report’s references to attacks against earlier SAP flaws should not be transferred to ICM2SHELL or PROXYGATE without evidence.
The release is also broader than these headline issues: SAP lists 35 new security notes, four GitHub advisories and three updates to earlier notes, and recommends prioritized patching. Administrators should therefore treat the four 10.0 flaws as the front of the queue—not the entire queue.