CVE-2026-89111

SAP released its November 2026 security updates, patching 35 vulnerabilities, including four rated at maximum severity (CVSS 10/10). Two critical vulnerabilities, CVE-2026-76964 and CVE-2026-89126, are collectively tracked as ICM2SHELL by Onapsis, enabling unauthenticated remote code execution on SAP's NetWeaver and Web Dispatcher components. Another critical flaw, CVE-2026-89103, known as PROXYGATE, allows attackers to bypass authentication and gain full control of SAP systems by impersonating internal servers. These vulnerabilities pose severe risks as they require no user interaction or credentials, exposing core business data and transaction integrity.