[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flOHa7YSO7BzrqZFp2qj6U0iLU2okcDBp-fMSUyzZhS8":3},{"article":4,"iocs":53,"watch_terms":64,"solutions":65,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"6a4f973b-9c67-4ae9-9e3d-3e2ed9d1d454","Hackers Can Exploit SAP PROXYGATE and ICM2SHELL Flaws for Unauthorized Full System Access","hackers-can-exploit-sap-proxygate-and-icm2shell-flaws-for-unauthorized-full-syst-2e8a30","SAP has released fixes for PROXYGATE and ICM2SHELL, critical security flaws that could let attackers take control of SAP systems without signing in. Disclosed during the November 10, 2026, Security Patch Day, the vulnerabilities carry maximum CVSS scores of 10.0 and affect core components used across business applications. Onapsis Research Labs discovered and reported both […] The post Hackers Can Exploit SAP PROXYGATE and ICM2SHELL Flaws for Unauthorized Full System Access appeared first on Cyber Security News.","SAP disclosed two critical vulnerabilities (CVSS 10.0) on November 10, 2026: PROXYGATE (CVE-2026-89103) in SAP Gateway and ICM2SHELL (CVE-2026-76964, CVE-2026-89126) in Internet Communication Manager and Web Dispatcher. Both flaws allow unauthenticated attackers with network access to execute commands under the adm account, compromising business data, credentials, and system availability. Onapsis Research Labs discovered both issues; patching requires configuration changes including enabling gw\u002Facl_mode_proxy = 1 and restricting proxy rules, as patching alone may not resolve exposure.","SAP patches PROXYGATE and ICM2SHELL critical flaws enabling unauthorized system access without authentication.","https:\u002F\u002Fcybersecuritynews.com\u002Fsap-proxygate-and-icm2shell-flaws\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FSAP-PROXYGATE-ICM2SHELL-Flaws.webp","2026-11-10T17:32:01+00:00","2026-11-10T18:01:12.092767+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"SAP","vendor",{"name":21,"type":22},"SAP Gateway","product",{"name":24,"type":22},"SAP Internet Communication Manager",{"name":26,"type":22},"SAP Web Dispatcher",{"name":28,"type":22},"SAP S\u002F4HANA",{"name":30,"type":31},"Onapsis Research Labs","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[54,58,61],{"type":55,"value":56,"context":57},"cve","CVE-2026-89103","PROXYGATE vulnerability in SAP Gateway allowing unauthorized command execution",{"type":55,"value":59,"context":60},"CVE-2026-76964","ICM2SHELL vulnerability in SAP Internet Communication Manager enabling memory corruption and command execution",{"type":55,"value":62,"context":63},"CVE-2026-89126","ICM2SHELL vulnerability in SAP Web Dispatcher and HANA XS component affecting WebSocket traffic handling",[18,21,24],{"controls":66,"vendors":154},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":126,"name":127,"problem":128,"products":129},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[],{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":165},"critical-sap-flaws-allow-unauthenticated-remote-code-execution-patching-alone-is-not-enough","Critical SAP Flaws Allow Unauthenticated Remote Code Execution — Patching Alone Is Not Enough","Two CVSS 10.0 vulnerabilities in SAP Gateway and Internet Communication Manager allow unauthenticated attackers with network access to execute arbitrary commands under a privileged account, potentially compromising the entire SAP landscape including business data and credentials. What makes these flaws especially dangerous is that applying the vendor patch is insufficient on its own — administrators must also implement specific configuration changes such as enabling gw\u002Facl_mode_proxy = 1 and tightening proxy access control lists. This highlights a critical gap in many organizations' patch processes: treating a patch deployment as a completed remediation without validating the accompanying hardening steps. SAP systems frequently host sensitive financial and operational data, meaning a full compromise carries severe business and regulatory consequences. Organizations running internet-facing SAP components without network controls are at the highest risk of exploitation.",[160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","NIST CSF 2.0 PR.PS-02: Software is maintained",{"NIS2 Article 21(2)(e)":166,"NIST SP 800-53 SI-2: Flaw Remediation":167,"NIST CSF 2.0 PR.PS-02: Software is maintained":168,"CIS Control 7: Continuous Vulnerability Management (v8)":169,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":170},"This point requires security in acquisition, development, and maintenance including vulnerability handling and disclosure, obligating operators of critical SAP systems to follow vendor remediation guidance in full, including mandatory configuration steps.","SI-2 requires that organizations not only install patches but also test and verify that remediation is complete, which would have caught that configuration changes were mandatory components of fixing these SAP flaws.","PR.PS-02 covers maintaining software in a secure state through patching and configuration management, which would have prompted administrators to apply both the SAP patches and the accompanying hardening parameters together as a single remediation action.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities, including verifying that configuration hardening steps accompany patches — the missing step that left SAP systems exposed even after patching.","CIS Control 4 mandates establishing and maintaining secure configurations, directly addressing the need to enable gw\u002Facl_mode_proxy = 1 and restrict proxy rules that SAP explicitly required as part of remediation."]