SAP's four CVSS 10.0 flaws: what NZ ERP owners should patch first

SAP's monthly security release on 10 November 2026 was heavier than usual. SAP's November 2026 security notes page lists 35 new security notes, four GitHub security advisories and three updates to earlier notes. Nine of them are rated Critical, and four carry the maximum CVSS score of 10.0. If your organisation runs SAP ECC, S/4HANA on-premise or private cloud, or any NetWeaver-based system such as BW or a portal, the release lands in your change calendar this month.

What SAP fixed

The four 10.0 notes all sit in the technical plumbing under the ERP. SAP's own table lists them as Note 3778530 (memory corruption in the Internet Communication Manager of NetWeaver AS ABAP), Note 3778556 (memory corruption in SAP Web Dispatcher), Note 3798345 (broken access control in SAP Gateway) and Note 3849308 (missing authentication in the SAML2 Service Provider of NetWeaver AS ABAP and the ABAP Platform). The GBHackers write-up of the release shows the same CVSS vector for all four: reachable over the network, low attack complexity, and no privileges or user interaction needed.

Onapsis, the SAP security firm that researched several of the flaws, has named two of them. Onapsis's patch day analysis calls the paired ICM and Web Dispatcher bugs "ICM2SHELL". The bug sits in how the SAP kernel handles WebSocket traffic, and an attacker can reach it before logging in. The Gateway issue, which Onapsis calls "PROXYGATE", comes from a default access control list that can treat an outside attacker as one of your own application servers. Onapsis describes PROXYGATE as pre-authentication remote code execution. The SAML2 flaw lets an unauthenticated attacker get past sign-on and impersonate users, including privileged accounts.

Below the top four, SAP's list includes a 9.9 OS command injection in the ABAP Application Server (Note 3792735), a 9.9 missing authorisation check in S4CRM (Note 3834842), a 9.6 cross-site request forgery in Web Dispatcher and ICM (Note 3804858) and a 9.1 XML external entity flaw in BusinessObjects Web Intelligence (Note 3799117).

Different sources count the release differently. Onapsis counts 43 new and updated notes, 12 of them HotNews. SAP counts new notes and updates separately. Plan your work from SAP's note list, because the tables published by researchers won't match each other line for line.

Exploitation status

At the time of writing, neither SAP nor the researchers have reported attacks using these flaws. GBHackers notes that the bulletin doesn't say the vulnerabilities are being actively exploited, and Onapsis doesn't say either way. Exploit code hasn't been published.

The 2022 ICMAD flaw (CVE-2022-22536) is the useful comparison. That one was also a CVSS 10 bug in the Internet Communication Manager. According to Security Affairs' report on the CISA warning, SAP shipped the ICMAD fix and the US Cybersecurity and Infrastructure Security Agency issued its alert on the same day, 8 February 2022. Government agencies treat pre-authentication bugs in the ICM as urgent because the ICM and Web Dispatcher are the parts of SAP most often exposed to the internet. They sit behind Fiori launchpads, supplier portals and API integrations. Onapsis says ICM2SHELL affects the component that usually faces the internet.

Why this release needs more than a normal patch cycle

Many NZ SAP customers patch quarterly or bundle kernel updates into support package projects. That timetable doesn't suit this release. ICM2SHELL is fixed in the SAP kernel, so the fix is a kernel and Web Dispatcher update with a restart. Those updates are usually quicker to test than ABAP corrections, but they still need an outage window on every affected application server.

PROXYGATE needs more than the patch. Onapsis puts it plainly: "After implementing the SAP Security Note, customers must manually set a profile parameter to be secure." A team that applies Note 3798345 and ticks the box will still be exposed if nobody changes the parameter. We'd expect partly fixed systems to be a common outcome across the market this month.

ICM2SHELL has a workaround, which is to turn off WebSocket support. Onapsis advises against it because of the impact on interactive and integration scenarios. Before choosing that route, check whether your Fiori apps, collaboration features or integrations depend on WebSockets.

For the SAML2 note, the risk depends on how you sign users in. If staff reach SAP through single sign-on from Microsoft Entra ID or another identity provider, the SAML2 Service Provider is in use and Note 3849308 belongs near the top of the list. Researchers' lists of affected SAP_BASIS releases don't agree, so confirm applicability in the note itself before deciding a system is out of scope.

What this means for NZ organisations

In New Zealand, SAP usually runs at larger manufacturers, food exporters, utilities, councils and government agencies, and a managed service partner often hosts or supports it. The main risk is confusion over who does what. Under hosting, RISE with SAP or application management contracts, kernel patching, Web Dispatcher maintenance, Gateway configuration and identity setup can belong to different parties. Your contract may say who owns each task, but you'll only know the job is done when someone confirms the fix and the PROXYGATE parameter on each production system.

The Web Dispatcher also turns up outside the core ERP. Onapsis notes that the HANA XSA Web Dispatcher is affected, so HANA-based analytics systems also need checking. SAP Content Server isn't affected. Organisations that put a reverse proxy or web application firewall in front of SAP can reduce exposure in the meantime. That only helps once you know which endpoints are reachable from outside.

For IT leaders, this release is a test of whether your ERP sits inside your vulnerability management process or alongside it. If your service desk tracks Windows and network patching against service levels but leaves SAP to a separate team with its own calendar, critical notes can sit unscheduled for weeks. Our ITIL 4 service management work treats ERP security notes as normal changes with a named owner, and we'd recommend the same discipline here.

Next steps for this week

• Build a list of every SAP system you run, including non-production, BW, portals, HANA XSA and standalone Web Dispatchers, with kernel and SAP_BASIS versions.
• Find out which ICM, Web Dispatcher and Gateway endpoints can be reached from the internet or from partner networks, and patch those first.
• Apply Notes 3778530 and 3778556 (ICM2SHELL) and Note 3798345 (PROXYGATE), then confirm the PROXYGATE profile parameter has been set and recorded on each system.
• Check whether SAML2 single sign-on is active and apply Note 3849308 where the note says your release is in scope.
• Ask your hosting or application management partner, in writing, which of the four 10.0 notes they'll apply, by what date, and how they'll show you the result.
• Schedule the remaining Critical notes, including the S4CRM and BusinessObjects fixes, in your next change window.
• Read the three revised notes from earlier months, because systems patched earlier may still need work.

Organisations planning a move off ECC or a change of SAP support partner can use this release to test how quickly a provider handles kernel-level security work. If you're reviewing how your ERP is supported, our ERP services page sets out how we approach system ownership and support models.