Security AlertCritical
SAP patches four unauthenticated 10/10 flaws in NetWeaver and Gateway
Nov 10, 2026 · Summarized by Fundy Tech from 3 sources
The 30-second version
SAP fixed four maximum-severity flaws in NetWeaver, Web Dispatcher and Gateway. The bugs can let attackers run code or take control without logging in.
Key points
- SAP patched 35 vulnerabilities in its November security updates.
- Four flaws were rated 10.0 and need no login to exploit.
- Onapsis tracked two bugs as ICM2SHELL and one as PROXYGATE.
Why it matters
SAP software runs core business systems. If these flaws are exposed on your network, an attacker could reach sensitive data or disrupt operations. Small businesses using SAP should treat this as urgent patching work.
Who’s affected: SAP NetWeaver, Web Dispatcher and Gateway users
What to do
- Apply SAP’s November security notes as a priority.
- Check whether your SAP Gateway, NetWeaver or Web Dispatcher is exposed.
- Upgrade out-of-maintenance kernels to supported versions.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.