---
title: Beyond Microsoft: SAP fixes four CVSS 10.0 NetWeaver, Web Dispatcher and Gateway flaws; Adobe patches CVSS 10 bugs in Connect; Ivanti ships 13 fixes | ctxsec
url: https://ctxsec.com/items/sap-adobe-ivanti-nov-2026-patch-day-icm2shell-proxygate-adobe-connect
description: "SAP released 35 new security notes plus four GitHub advisories, with four rated 10.0: memory corruption in the NetWeaver ICM (CVE-2026-76964) and Web Dispatcher (CVE-2026-89126) via WebSocket frames, which Onapsis calls ICM2SHELL; missing authentication in the ABAP SAML2 service provider (CVE-2026-120017) that can let an attacker sign in as any user; and SAP Gateway broken access control (CVE-2026-89103, 'ProxyGate'), whose fix also needs a manual profile parameter change. Adobe published nine bulletins covering 110 CVEs, led by Connect (APSB26-191, 24 CVEs, several CVSS 10.0) and Experience Manager (APSB26-189). Ivanti disclosed fixes for Endpoint Manager, EPMM, Sentry, CSA and User Workspace Manager. None of the three vendors report exploitation."
status: "official (SAP Security Patch Day page, Adobe Trust Center and Ivanti blog, Nov 10, 2026); none reported exploited; Adobe counts per ZDI and SecurityWeek"
published: 2026-11-10
---

> SAP released 35 new security notes plus four GitHub advisories, with four rated 10.0: memory corruption in the NetWeaver ICM (CVE-2026-76964) and Web Dispatcher (CVE-2026-89126) via WebSocket frames, which Onapsis calls ICM2SHELL; missing authentication in the ABAP SAML2 service provider (CVE-2026-120017) that can let an attacker sign in as any user; and SAP Gateway broken access control (CVE-2026-89103, 'ProxyGate'), whose fix also needs a manual profile parameter change. Adobe published nine bulletins covering 110 CVEs, led by Connect (APSB26-191, 24 CVEs, several CVSS 10.0) and Experience Manager (APSB26-189). Ivanti disclosed fixes for Endpoint Manager, EPMM, Sentry, CSA and User Workspace Manager. None of the three vendors report exploitation.

[← Cybersecurity News](/news) · [markdown](/items/sap-adobe-ivanti-nov-2026-patch-day-icm2shell-proxygate-adobe-connect.md)

official (SAP Security Patch Day page, Adobe Trust Center and Ivanti blog, Nov 10, 2026); none reported exploited; Adobe counts per ZDI and SecurityWeek

2026-11-10

### Beyond Microsoft: SAP fixes four CVSS 10.0 NetWeaver, Web Dispatcher and Gateway flaws; Adobe patches CVSS 10 bugs in Connect; Ivanti ships 13 fixes

- **SAP first:** ICM2SHELL needs no authentication and hits the component that faces the network; the Web Dispatcher in HANA XS Classic/Advanced is affected too. After applying note 3798345 for ProxyGate, set the profile parameter SAP documents, or the gateway stays open.
- **SAP SAML:** note 3849308 matters only where SAML2 SSO is configured, but there it's full user impersonation.
- **Adobe Connect and AEM** are Priority 2; everything else from Adobe is Priority 3.
- **Ivanti** says it is using LLMs in product security and expects more disclosures as a result, the same pattern as Fortinet's AI-found bugs this month.

Sources: [SAP Security Patch Day - November 2026](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html) · [Onapsis: SAP Security Patch Day November 2026](https://onapsis.com/blog/sap-security-patch-day-nov-2026/) · [Adobe Trust Center: Security bulletins and advisories (updated Nov 10, 2026)](https://www.adobe.com/trust/security/bulletins-and-advisories.html) · [Zero Day Initiative: The November 2026 Security Update Review (Nov 10, 2026)](https://www.thezdi.com/blog/2026/11/10/the-november-2026-security-update-review) · [Ivanti: November 2026 Security Update](https://www.ivanti.com/blog/november-2026-security-update)