SAP released fixes for four maximum-severity vulnerabilities that need no user login, including flaws in NetWeaver's ICM and Web Dispatcher that could let network attackers run code. It also patched SAML sign-in and Gateway flaws, while researchers warned some out-of-maintenance kernels may remain unfixed.