Hackers Can Exploit SAP PROXYGATE and ICM2SHELL Flaws for Unauthorized Full System Access

Two CVSS 10.0 vulnerabilities in SAP Gateway and Internet Communication Manager allow unauthenticated attackers with network access to execute arbitrary commands under a privileged account, potentially compromising the entire SAP landscape including business data and credentials. What makes these flaws especially dangerous is that applying the vendor patch is insufficient on its own — administrators must also implement specific configuration changes such as enabling gw/acl_mode_proxy = 1 and tightening proxy access control lists. This highlights a critical gap in many organizations' patch processes: treating a patch deployment as a completed remediation without validating the accompanying hardening steps. SAP systems frequently host sensitive financial and operational data, meaning a full compromise carries severe business and regulatory consequences. Organizations running internet-facing SAP components without network controls are at the highest risk of exploitation.