Overview
- SAP published fixes on Tuesday for four maximum‑severity vulnerabilities rated 10.0 that affect NetWeaver, Web Dispatcher and Gateway.
- The flaws map to CVE‑2026‑76964, CVE‑2026‑89126, CVE‑2026‑89103 and CVE‑2026‑120017 and are tracked by researchers as ICM2SHELL (ICM/Web Dispatcher) and PROXYGATE (Gateway).
- Two memory‑corruption bugs in ICM and Web Dispatcher can allow unauthenticated remote code execution and a Gateway access‑control weakness can let an attacker impersonate internal application servers.
- SAP published each fix as a separate SAP Note in the SAP for Me portal and warned some issues have no practical workaround while temporary mitigations such as disabling WebSocket can break functionality.
- Because these components sit at network edges and SAP has fixed several recent high‑severity bugs, analysts and CISA guidance say enterprises must prioritize coordinated kernel and dispatcher rollouts to avoid full ERP compromise and operational disruption.