SAP patches ICM2SHELL and PROXYGATE maximum severity flaws

SAP's NetWeaver, Gateway, and Web Dispatcher components contained four CVSS 10.0 vulnerabilities — dubbed ICM2SHELL and PROXYGATE — that allowed unauthenticated attackers to execute arbitrary code and fully compromise affected systems. The root cause is unpatched, internet-facing enterprise software with critical security flaws in core communication components that handle external traffic. Because no authentication is required for exploitation, any organization running unpatched SAP systems is exposed to immediate, complete compromise. This incident underscores how maximum-severity vulnerabilities in widely deployed enterprise platforms can serve as direct entry points for ransomware, espionage, and data theft at scale.