Icm2shell Cve 2026 76964 Cve 2026 89126 Sap Netweaver Web Dispatcher Threat Advisory

Navigating November’s Historic SAP Security Patch Day – LIVE WEBINAR Join Onapsis to talk through November’s Vulnerabilities. November 12th, 10am ET Register here

As part of today’s SAP Security Patch Day, SAP released SAP Security Notes # 3778530 (CVE-2026-76964, ICM) and # 3778556 (CVE-2026-89126, SAP Web Dispatcher, including the one embedded in SAP HANA XS), along with FAQ Note # 3778788 , to fix ICM2SHELL , a vulnerability discovered and reported by the Onapsis Research Labs (ORL). Both notes were

In summary, ICM2SHELL is a memory corruption vulnerability in the way the SAP Kernel handles WebSocket traffic. Because that code is shared by the ICM and the SAP Web Dispatcher, both are affected, including the component that usually faces the Internet. An attacker with network access to their HTTP/HTTPS port can corrupt the memory of the process and run operating system commands as adm, gaining complete control of the affected SAP system, or simply crash it at will. WebSocket support is enabled by default, whether or not it is used, and SAP S/4HANA systems even ship with ICF services that accept WebSocket connections without authentication. No credentials, no user interaction and no misconfiguration are required.

We want to acknowledge the SAP Product Security Response Team (PSRT) for their collaboration and prompt response. Onapsis reported this issue to SAP through our ongoing coordinated-disclosure partnership. SAP PSRT responded swiftly and released a fix as part of its November Security Patch Day, serving as a reflection of the maturity of SAP’s security response process and its strong commitment to protecting its customers. This post makes defenders aware of the risk, describes the shape of the vulnerability at a level actionable for security and SAP Basis teams, and explains what protections are already in place.

As of the date of this publication, the Onapsis Research Labs have not observed active in-the-wild exploitation of this vulnerability. We continue to monitor our SAP Global Threat Intelligence Network and will deliver in-product updates and threat insights (including indicators of compromise) to our clients if that happens. We will update this blog post with any observations for public knowledge and consumption as well.

The Onapsis Research Labs adhere to a strict set of responsible disclosure practices. Consequently, this post will intentionally omit technical exploitation details at this time and is solely focused on helping SAP customers assess exposure and support prompt risk remediation actions.

What is the ICM2SHELL (CVE-2026-76964 and CVE-2026-89126) Vulnerability?

The SAP Internet Communication Manager (ICM) is the SAP Kernel component that receives HTTP, HTTPS and WebSocket traffic for an SAP system. Every browser session, Fiori app, OData call and web service request reaches the SAP system through it. The SAP Web Dispatcher (WD), the reverse proxy that many organizations place at the edge of their network, is built on the same code base.

WebSocket is the protocol that lets a browser and a server keep a connection open and exchange messages in both directions. A connection starts as an ordinary HTTP request asking to be “upgraded”; once the server agrees, both sides switch to exchanging WebSocket messages. Large messages can be split into fragments, and the receiver puts the fragments back together before handing the message to the application.

ICM2SHELL lives in that reassembly step. A specially crafted sequence of WebSocket messages makes the ICM or the WD write attacker-controlled data past the end of the memory it reserved for the connection. Depending on how that data is shaped, the result is either an immediate crash of the process or controlled corruption of its memory, which an attacker can turn into arbitrary operating system commands running as adm.

This is not a theoretical outcome. The Onapsis Research Labs provided SAP a working exploit that achieves full, unauthenticated remote code execution end to end, running arbitrary commands as adm on the target system. The denial-of-service condition, in turn, reproduced on every SAP Kernel release tested.

To reach the flaw, an attacker only needs network access to the HTTP/HTTPS port. Because WebSocket support is enabled by default in both the ICM and the SAP Web Dispatcher, a system is exposed even if no application uses WebSocket. Some services, including default ICF services in SAP S/4HANA, accept WebSocket connections without authentication, and in others the flaw can be reached before authentication takes place. Nothing in the chain requires an SAP user, a password or a certificate.

The SAP Web Dispatcher deserves particular attention. It does not just pass WebSocket traffic through: it reassembles the messages itself with the same vulnerable code, so the attacker’s messages corrupt the Web Dispatcher’s own memory. The component designed to protect the SAP system from the Internet becomes the first one exposed to it.

The Risk and Impact of ICM2SHELL on SAP Landscapes

The adm account owns the SAP installation: its executables, its instance profiles, its secure store, and its connection to the database. Running commands as that user grants, in practice, full control of the SAP system. An attacker could, among other things:

Recover database credentials and other secrets from the secure store and profiles, and use them to read or alter any business data directly in the database;

Collect RFC destinations and technical credentials that let them move on to the SAP and non-SAP systems connected to this one;

Change configuration or binaries to keep persistent access;

Stop the SAP system or destroy data, with immediate impact on the business processes it runs.

For an ERP system, this means direct exposure of financial, HR, supply chain and customer data, the integrity of the transactions built on it, and the regulatory reporting obligations (e.g., SOX, US SEC disclosure rules, NIS2, GDPR, and others) that follow from a compromise.

Denial of Service Is the Floor, Not the Ceiling

Even without reaching code execution, the same flaw reliably crashes the ICM/WD process with a single connection on every release tested. The process restarts, but while it does, every Fiori app, web service and API it serves is unavailable, and repeating the attack keeps it down. When the target is a Web Dispatcher, the outage extends to every SAP system behind it.

Reachable From the Internet

The ICM and the SAP Web Dispatcher are, by design, the parts of an SAP landscape most likely to face the Internet, whether to serve Fiori to remote users, expose APIs to partners, or support cloud integrations. Unlike vulnerabilities in internal-only services, ICM2SHELL does not require the attacker to already be inside the corporate network in many real deployments.

Exposure is determined by the SAP Kernel (not by the application release), so it applies to any SAP NetWeaver AS ABAP system running kernel 7.40 or higher and to any WD, including the one embedded in SAP HANA XS. SAP NetWeaver AS Java is not affected, but dual-stack installations are, because of their ABAP stack. The following are the patch levels that include the fixes for ICM2SHELL :

Kernel releases that are no longer under maintenance (7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89) are also affected and may not receive a fix. They must be upgraded to a supported downward-compatible kernel (see SAP Note # 3778788 , FAQ #4). Kernel 7.22 is not affected.

Is your kernel on a fixed patch level? We recommend applying the latest available patch for your release, since the exact patch levels listed may no longer be available for download. Note that for 7.93 a higher patch level does not always mean a fixed one: PL 419, for example, is still affected. Only the updated PL 401 Stack Kernel, PL 402 (once released) and PL 420 or higher include the fix (see SAP Note # 3778788 , FAQ #6). If your kernel is below the fixed patch level, your system is vulnerable.

Is there a Web Dispatcher in front? If so, check it separately: it is affected on its own, regardless of the systems behind it. A WD on the higher patch levels described under Temporary Workarounds can also protect backends that are accessed exclusively through it.

Customers running SAP systems in SAP’s Private Cloud (for example, under RISE with SAP) should also review SAP Note # 3849055 , the Private Cloud Operations FAQ for these security notes.

Remediation Plan (Prioritized Actions)

Applying SAP Security Notes # 3778530 and # 3778556 is the only complete fix. The actions below are ordered to reduce risk as quickly as possible while the rollout is in progress.

Assess and identify. Build the list of affected systems from kernel release and patch level. Include the ones that tend to be missed: standalone Web Dispatchers, the WD embedded in SAP HANA XS Classic and XS Advanced, non-production systems holding copies of production data, and legacy systems running kernel releases that are no longer under maintenance.

Patch Internet-facing Web Dispatchers and ICMs first. These are reachable by anyone, and a compromised Web Dispatcher sits in front of every system it routes to. Make them your very first patch. A WD updated to the higher patch levels listed under Temporary Workarounds also shields the backends that are accessed exclusively through it.

Apply a temporary workaround where you cannot patch immediately. SAP provides two workarounds for systems that cannot be patched right away. Both have limitations and can affect scenarios in use, so assess them before applying. See the Temporary Workarounds section below.

Patch internal systems, starting with production. Prioritize production systems and those holding your most sensitive data. Remember that the fix is in the kernel, so don’t limit your response to just the primary instance. Every application server and every Web Dispatcher needs it.

Narrow network access to the ICM and WD. Restrict the HTTP/HTTPS ports to the networks and users that genuinely need them. This does not fix the vulnerability, but it shrinks the population that can attempt it.

Watch for crashes while you patch. Every exploitation attempt is likely to crash the ICM or WD at least once. Unexpected restarts, recorded in dev_icm or dev_webdisp in the work directory, deserve investigation, as do changes in the process ID of icman or the Web Dispatcher outside planned maintenance.

Temporary Workarounds

SAP describes two workarounds in SAP Note # 3778788 . Both are temporary and do not replace the patch. SAP recommends assessing their applicability to your landscape before implementing them, since they can affect scenarios that are currently in use.

Using a WD on higher patch levels as a shield (FAQ #14)

A WD updated to 7.53 PL 1629, 7.54 PL 723, 7.93 PL 430, 9.16 PL 200 or higher can protect the backends behind it. These patch levels are higher than those listed in the security notes, because the workaround requires additional corrections. Limitations:

It only protects backends that are accessed exclusively through that WD. If a backend can be reached directly, it is not protected.

It does not work if the WD is configured with icm/server_port_ = PROT=ROUTER .

Disabling WebSocket support (FAQ #15)

Setting icm/HTTP/support_websocket_upgrade=FALSE and restarting the component removes the vulnerability. However, multiple features depend on WebSocket, and SAP warns that disabling it has a significant impact on interactive and integration scenarios.

Before disabling it, check whether WebSocket is in use by looking for requests with status code 101 in the ICM/WD HTTP log. This log is enabled by default in release 7.73 and higher and in XS Advanced, but must be configured explicitly in release 7.54 and lower and in XS Classic (see FAQ #15.1). If there are no such requests, WebSocket can be disabled without affecting running scenarios. Note that not using WebSocket does not make a system safe: it remains vulnerable until WebSocket support is disabled or the patch is applied.

The exact location of the parameter differs for AS ABAP, standalone WD, HANA XS Classic and XS Advanced. See FAQ #15.2 for each case.

As one of the most prolific contributors to SAP security research, the Onapsis Research Labs has discovered and helped remediate well over 1,000 zero-day vulnerabilities in SAP business applications, and continues to partner closely with SAP to protect the global SAP customer base. This reflects the strong, long-standing relationship between the Onapsis Research Labs and SAP’s Product Security Response Team, and SAP’s proactive investment in securing its platform.

Protected BEFORE the Patch.

Because the Onapsis Research Labs discovered the vulnerability and helped SAP mitigate it, the intelligence and detection content required to protect against it were developed and delivered as part of the coordinated disclosure process, providing our customers with zero-day coverage prior to the patch being available. Throughout this period, the Onapsis Research Labs have been monitoring the global SAP threat landscape via our Global Threat Intel Network for any early signs of malicious activity. In product, Onapsis Defend has been actively monitoring customer landscapes for ICM2SHELL since well before today’s patch release, keeping our customers protected throughout the coordinated-disclosure window.

Supported AFTER the Patch.

Zero-day rules in Defend are now to established production rules, effective immediately. Furthermore, Onapsis customers are able to take action within the Onapsis Platform immediately:

Onapsis Assess has been updated with new checks that identify exactly which systems in your estate are exposed to ICM2SHELL , so security and Basis teams can prioritize the patch rollout precisely rather than sweeping the whole landscape.

Onapsis Defend provides continuous detection for the exploitation pattern, giving teams coverage during the window between disclosure and full patch deployment, the period when exposure is highest.

And the Onapsis Research Labs continue to track exploitation activity, indicators, and attacker behavior in the wild, feeding updated intelligence back into detection content and Threat Dispatches for customers, so protection keeps pace with the evolving threat.

Taken all together, the full product coverage by Onapsis transforms a high-pressure critical patching event into a guided, measurable process. This is what it means for a security vendor to inform and keep SAP customers well ahead of the threat: robust protection before the patch is released, expert guidance through remediation when a patch is released, and continuous monitoring of the threat long after SAP Security Patch Day has come and gone to ensure customers remain protected.

ICM2SHELL turns a routine part of web traffic into a point of ingress for attackers. A specially crafted sequence of WebSocket messages makes the ICM or WD write past the memory it reserved for a connection. Shaped carefully, that corruption becomes arbitrary operating system commands running as adm .

The result is remote code execution against the component that faces the network by design: no SAP user, no password and no user interaction. The SAP Web Dispatcher shares the flaw, so the layer intentionally meant to shield the SAP landscape is unfortunately also exposed. At a minimum, any attacker who can reach it can take the web front end offline at will.

The fix is available today in SAP Security Notes # 3778530 and # 3778556 , and SAP Note # 3778788 describes temporary workarounds for systems that cannot be patched immediately. This blog is meant first to help the SAP customer community understand the vulnerability and determine, clearly, whether their own systems are affected. Onapsis customers get all of these checks — and immediate, automatic detection of exploitation attempts, even before the patch — directly through the Onapsis Platform. If you are not a customer and want help understanding your exposure, get in touch with us.