[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f920rxRex_wHefJRjVrdfDPaCKA5G2gY2Y4h9JVM3wx8":3},{"article":4,"iocs":50,"watch_terms":72,"solutions":73,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"39addcb7-35b5-47d8-9f07-c5169e8a8aec","SAP patches ICM2SHELL and PROXYGATE maximum severity flaws","sap-patches-icm2shell-and-proxygate-maximum-severity-flaws-4864fb","SAP patched 35 vulnerabilities in its November 2026 security updates, including four maximum-severity issues affecting its NetWeaver, Web Dispatcher, and Gateway software. [...]","SAP has released security updates addressing 35 vulnerabilities, including four critical issues with a CVSS score of 10\u002F10. These flaws affect NetWeaver, SAP Gateway, and SAP Web Dispatcher, and can be exploited by unauthenticated attackers for remote code execution and full system compromise. Cybersecurity firm Onapsis identified and reported three of these vulnerabilities, tracking two as ICM2SHELL and one as PROXYGATE.","SAP patches four maximum-severity flaws in NetWeaver, Web Dispatcher, and Gateway software.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fsap-patches-four-maximum-severity-security-vulnerabilities\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F10\u002FSAP.jpg","2026-11-10T12:07:03+00:00","2026-11-10T13:00:25.122032+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"SAP","vendor",{"name":21,"type":22},"NetWeaver","product",{"name":24,"type":22},"Web Dispatcher",{"name":26,"type":22},"Gateway",{"name":28,"type":22},"Commerce Cloud",{"name":30,"type":31},"OAuth2","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,57,60,63,66,69],{"type":52,"value":53,"context":54},"cve","CVE-2026-76964","Maximum severity flaw in NetWeaver Application Server ABAP's Internet Communication Manager and SAML2 Service Provider components.",{"type":52,"value":56,"context":54},"CVE-2026-120017",{"type":52,"value":58,"context":59},"CVE-2026-89103","Maximum severity flaw in SAP Gateway (PROXYGATE).",{"type":52,"value":61,"context":62},"CVE-2026-89126","Maximum severity flaw in SAP Web Dispatcher (ICM2SHELL).",{"type":52,"value":64,"context":65},"CVE-2026-58231","Maximum severity flaw in SAP Commerce Cloud, flagged as actively exploited.",{"type":52,"value":67,"context":68},"CVE-2026-44756","Maximum severity memory corruption flaw in SAP Kernel code (OVERPASS).",{"type":52,"value":70,"context":71},"CVE-2026-89111","Maximum severity OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.",[18,21,24],{"controls":74,"vendors":162},[75,104,133],{"slug":76,"name":77,"problem":78,"products":79},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":105,"name":106,"problem":107,"products":108},"patch-management","Automated patch management","Known holes get closed in days, not months.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":134,"name":135,"problem":136,"products":137},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[138,146,154],{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":155,"vendor_name":156,"vendor_logo":157,"product_slug":158,"product_name":159,"url":160,"description":161},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[],{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":173},"maximum-severity-sap-flaws-allow-unauthenticated-remote-code-execution","Maximum-Severity SAP Flaws Allow Unauthenticated Remote Code Execution","SAP's NetWeaver, Gateway, and Web Dispatcher components contained four CVSS 10.0 vulnerabilities — dubbed ICM2SHELL and PROXYGATE — that allowed unauthenticated attackers to execute arbitrary code and fully compromise affected systems. The root cause is unpatched, internet-facing enterprise software with critical security flaws in core communication components that handle external traffic. Because no authentication is required for exploitation, any organization running unpatched SAP systems is exposed to immediate, complete compromise. This incident underscores how maximum-severity vulnerabilities in widely deployed enterprise platforms can serve as direct entry points for ransomware, espionage, and data theft at scale.",[168,169,170,171,172],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","NIST CSF 2.0 RS.MI-2: Incident Mitigation",{"NIS2 Article 21(2)(e)":174,"NIST SP 800-53 SI-2: Flaw Remediation":175,"NIST CSF 2.0 RS.MI-2: Incident Mitigation":176,"CIS Control 12: Network Infrastructure Management (v8)":177,"CIS Control 7: Continuous Vulnerability Management (v8)":178},"This point requires security in acquisition, development, and maintenance including vulnerability handling and disclosure; organizations operating SAP systems are obligated to have processes that ensure critical vendor patches are applied rapidly.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes; a timely patch cycle for these maximum-severity SAP vulnerabilities is precisely what this control demands.","This category requires that incidents are contained and mitigated; having pre-defined network controls and emergency patching procedures in place limits the blast radius when maximum-severity RCE vulnerabilities are disclosed.","CIS Control 12 calls for restricting access to network-facing services; limiting external exposure of SAP ICM and Web Dispatcher endpoints would have reduced the attack surface exploitable by unauthenticated attackers.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying SAP's patches promptly for these CVSS 10 flaws is exactly the prioritized remediation process this control mandates."]