[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fneefLw75H8OgGRdpFEknNWj6bhMkfgFYVPcO-4OTk1Q":3},{"article":4,"iocs":50,"watch_terms":77,"solutions":78,"lesson":167},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"9ad99b93-d378-43dc-92a5-43e4effd0f9d","SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities","sap-patches-critical-icm2shell-proxygate-vulnerabilities-6d0261","SAP has published 42 new and updated security advisories, including nine that address critical-severity vulnerabilities. The post SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities appeared first on SecurityWeek.","SAP has released 42 new and updated security advisories, with nine addressing critical-severity vulnerabilities. Two of these, ICM2SHELL (CVE-2026-76964, CVE-2026-89126) and ProxyGate (CVE-2026-89103), are maximum-severity flaws in the SAP kernel that could allow unauthenticated remote code execution with administrative privileges. A missing authentication bug (CVE-2026-120017) and five other critical vulnerabilities were also patched, alongside 17 high-severity fixes.","SAP releases 42 security advisories, including nine critical flaws in ICM2SHELL and ProxyGate.","https:\u002F\u002Fwww.securityweek.com\u002Fsap-patches-critical-icm2shell-proxygate-vulnerabilities\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FSAP_vulnerability-patches.jpg","2026-11-10T14:46:28+00:00","2026-11-10T15:00:26.75992+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"SAP","vendor",{"name":21,"type":22},"NetWeaver","product",{"name":24,"type":22},"Web Dispatcher",{"name":26,"type":22},"Gateway",{"name":28,"type":22},"BusinessObjects",{"name":30,"type":31},"ICM2SHELL","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,57,60,63,66,68,71,74],{"type":52,"value":53,"context":54},"cve","CVE-2026-76964","ICM2SHELL vulnerability in SAP kernel",{"type":52,"value":56,"context":54},"CVE-2026-89126",{"type":52,"value":58,"context":59},"CVE-2026-89103","ProxyGate vulnerability in SAP Gateway",{"type":52,"value":61,"context":62},"CVE-2026-120017","Missing authentication bug in NetWeaver",{"type":52,"value":64,"context":65},"CVE-2026-109803","Vulnerability in NetWeaver",{"type":52,"value":67,"context":65},"CVE-2026-76965",{"type":52,"value":69,"context":70},"CVE-2026-109795","Vulnerability in S4CRM",{"type":52,"value":72,"context":73},"CVE-2026-89119","Vulnerability in Web Dispatcher",{"type":52,"value":75,"context":76},"CVE-2026-109798","Vulnerability in BusinessObjects",[18,21,24],{"controls":79,"vendors":166},[80,109,138],{"slug":81,"name":82,"problem":83,"products":84},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":110,"name":111,"problem":112,"products":113},"patch-management","Automated patch management","Known holes get closed in days, not months.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":49,"name":139,"problem":140,"products":141},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[142,150,158],{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":159,"vendor_name":160,"vendor_logo":161,"product_slug":162,"product_name":163,"url":164,"description":165},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[],{"slug":168,"title":169,"body":170,"framework_refs":171,"framework_notes":177},"critical-sap-kernel-flaws-enable-unauthenticated-remote-code-execution","Critical SAP Kernel Flaws Enable Unauthenticated Remote Code Execution","SAP disclosed maximum-severity vulnerabilities in its kernel — ICM2SHELL and ProxyGate — that allow unauthenticated remote attackers to execute code with administrative privileges, alongside a missing authentication flaw affecting additional components. These flaws require no credentials, dramatically lowering the bar for exploitation and making every unpatched SAP system an immediate target. Because SAP environments typically host sensitive business data and core enterprise processes, successful exploitation can have catastrophic operational and data-integrity consequences. Organizations that delay patching SAP kernel vulnerabilities expose themselves to full system compromise with minimal attacker effort.",[172,173,174,175,176],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.MI-03: Newly identified vulnerabilities are mitigated or documented as accepted risks","NIS2 Article 21(2)(e)","OWASP A01:2021 Broken Access Control",{"NIS2 Article 21(2)(e)":178,"OWASP A01:2021 Broken Access Control":179,"NIST SP 800-53 SI-2: Flaw Remediation":180,"CIS Control 7: Continuous Vulnerability Management (v8)":181,"NIST CSF 2.0 RS.MI-03: Newly identified vulnerabilities are mitigated or documented as accepted risks":182},"NIS2 Article 21(2)(e) specifically covers vulnerability handling and disclosure in the context of security in acquisition, development and maintenance, obligating operators to have processes for rapidly addressing critical vendor-disclosed flaws like these SAP kernel vulnerabilities.","The missing authentication vulnerability (CVE-2026-120017) is a direct instance of broken access control, where functionality that should require authentication can be reached by unauthenticated users.","SI-2 mandates identifying, reporting, and correcting system flaws within organizationally defined time frames, which directly applies to the obligation to patch these maximum-severity SAP kernel vulnerabilities promptly.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; a formal process here would have ensured the critical SAP kernel flaws were identified and patched before attackers could exploit them.","This category requires organizations to act on newly disclosed vulnerabilities; the ICM2SHELL and ProxyGate disclosures demand immediate mitigation to prevent unauthenticated remote code execution."]