Three of the flaws are in the SAP NetWeaver application server, which SAP systems run on, and one is in the Web Dispatcher, which receives requests from the internet and passes them to the server. The flaws in the ICM, the component that handles the server's web traffic (CVE-2026-76964), and in the Web Dispatcher (CVE-2026-89126) stem from a shared bug that security firm Onapsis calls ICM2SHELL: crafted traffic can corrupt memory and allow code execution. According to Onapsis, WebSocket support is on by default, so a system is exposed even if it doesn't use it, and the bug can also crash a Web Dispatcher and cut off every SAP system behind it.
The third flaw, CVE-2026-120017 in the SAML 2.0 component, could let an attacker log in as any user, including privileged users, on some systems that use single sign-on (SSO). The fourth, CVE-2026-89103 in SAP Gateway, which the researchers call PROXYGATE, lets an external attacker be treated as one of the system's own application servers and take unauthorized actions. Onapsis, which found three of the flaws, says it has not seen them exploited in attacks.
What to do: SAP recommends applying the fixes as a priority; they are published in SAP for Me. According to Onapsis, kernel versions that are out of maintenance are affected too and may not get a fix, so they need an upgrade to a supported version. RedRays recommends updating the kernel and all Web Dispatchers in a single rollout.
