SAP NetWeaver ICM2SHELL: Pre-Auth RCE (CVE-2026-76964)

TL;DR

• ICM2SHELL is a memory-corruption bug in the SAP Kernel's WebSocket handling, shared by the Internet Communication Manager (ICM) and the SAP Web Dispatcher. A crafted sequence of WebSocket messages crashes the process or runs commands as <sid>adm.
• It affects SAP NetWeaver AS ABAP on kernel 7.40 and later and every Web Dispatcher, including the one embedded in SAP HANA XS. AS Java is not affected directly.
• SAP rates CVE-2026-76964, CVE-2026-89126, CVE-2026-89103 and CVE-2026-120017 CVSS v3.1 10.0 Critical. No exploitation is known, CISA records none, and none is in KEV as of November 14, 2026.
• Apply SAP Notes 3778530 and 3778556 for the ICM and Web Dispatcher, 3798345 for the gateway, and 3849308 for SAML2. The fixed kernel patch levels are in How do I fix it?.

Am I affected?

You are exposed to ICM2SHELL when both of these hold:

• The system runs SAP NetWeaver AS ABAP on an SAP Kernel release 7.40 or later, or it runs any SAP Web Dispatcher.
• An attacker can reach the HTTP or HTTPS port that the ICM or Web Dispatcher serves.

Any Web Dispatcher counts, including a standalone one and the one embedded in SAP HANA XS Classic or XS Advanced. SAP NetWeaver AS Java is not affected by ICM2SHELL. A dual-stack system is affected through its ABAP stack. SAP Content Server is not affected. Kernel 7.22 is not affected.

The same patch day fixes three other pre-auth flaws with separate exposure rules:

• PROXYGATE (CVE-2026-89103) affects any system that runs an SAP Gateway, including ABAP, AS Java, dual-stack and standalone gateways. The gateway proxy policy decides whether it is exploitable.
• The SAML2 flaw (CVE-2026-120017) affects NetWeaver AS ABAP systems that use the SAML2 Service Provider under the configurations SAP describes in Note 3849308.

For kernel 7.93, a higher patch number alone does not prove the fix is present: PL 419 is still affected. Use the updated PL 401 Stack Kernel, PL 402 once released, or PL 420 or later, and check SAP Note 3778788 FAQ 6 for the correct branch.

The table lists nine fixed rows and one row for kernels that SAP no longer maintains. These are the patch levels for the ICM and Web Dispatcher fixes. The gateway patch levels are different and appear under How do I fix it?.

SAP's November patch day released 43 new and updated security notes, including 12 HotNews and 13 High Priority notes. Four carry CVSS v3.1 10.0.

Check the running kernel on every application server and every Web Dispatcher, not only the primary instance:

# On every application server, including each additional one
disp+work -v

# Through sapcontrol, for each instance number
sapcontrol -nr <NR> -function GetVersionInfo | grep -Ei 'kernel|patch'

# Gateway proxy mode: 1 is restrictive, 0 or an absent parameter is the default allow-all
sapcontrol -nr <NR> -function ParameterValue gw/acl_mode_proxy

disp+work -v prints the kernel release and patch number of the running binary. Compare that patch number with the row for your release. On a Web Dispatcher, read the same values from its version output or from the first lines of dev_webdisp in the instance work directory.

How do I fix it?

Apply the SAP Notes for every affected component and restart it, because the fix ships in the kernel binary.

1. Apply Note 3778530 to every AS ABAP application server and Note 3778556 to every Web Dispatcher, including the embedded HANA XS and XS Advanced components. Reach the patch level in the table.
2. Apply Note 3798345 to every gateway, then set gw/acl_mode_proxy = 1 where the kernel supports it. Kernels 7.93 and 9.16 already support the parameter. Kernels 7.22, 7.53, 7.54, 7.77 and 8.04 gain it with the note.
3. Apply Note 3849308 to the affected SAP_BASIS releases for the SAML2 flaw, then review the trusted identity providers in transaction SAML2.
4. Restart every patched component and confirm the running kernel patch number. An installed support package without a restart leaves the vulnerable binary in memory.
5. Restrict network access to the ICM and Web Dispatcher HTTP/HTTPS ports and to gateway ports 33NN and 48NN.

The gateway fix uses its own patch levels, because the gateway code is a different part of the kernel:

Kernels 7.20, 7.21, 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 are out of maintenance. Upgrade them to a supported downward-compatible kernel, as SAP Note 3810197 describes.

Two SAP-supported workarounds reduce exposure for ICM2SHELL. Neither replaces the patch, and both change behavior.

1. Disable WebSocket. Set icm/HTTP/support_websocket_upgrade=FALSE in the profile and restart the ICM or Web Dispatcher. This removes the vulnerable path, but it breaks ABAP Push Channels and some Fiori and integration scenarios. Check the HTTP log for status code 101 first, because a system with no WebSocket traffic loses less.
2. Shield backends with a patched Web Dispatcher. A Web Dispatcher at 7.53 PL 1629, 7.54 PL 723, 7.93 PL 430, 9.16 PL 200 or later protects only the systems reached exclusively through it. It does not protect a backend that an attacker can reach directly. It also does not work when the Web Dispatcher uses icm/server_port_<x> = PROT=ROUTER.

On the gateway, a restrictive prxyinfo file is the interim control. Replace any rule such as P SOURCE=* DEST=* with rules limited to trusted hosts and destinations. When no prxyinfo file exists and the kernel does not yet support the parameter, create one until the patch is applied. SAP lists no workaround that replaces Note 3798345.

The public analysis lists no workaround for the SAML2 flaw. Applying Note 3849308 is the fix.

What is the root cause?

The ICM is the SAP Kernel component that receives HTTP, HTTPS and WebSocket traffic for an ABAP system. Every browser session, Fiori app, OData call and web service request passes through it. The SAP Web Dispatcher is a reverse proxy built on the same kernel code, and it reassembles WebSocket messages itself instead of only forwarding them.

ICM2SHELL is a heap memory-corruption bug in that WebSocket reassembly step. A WebSocket connection starts as an HTTP request that asks to be upgraded. Messages can then be split into fragments, and the receiver joins them before handing the message to the application. Onapsis found that some size and length parameters in WebSocket control frames are not properly validated.

A crafted sequence of frames makes the ICM or Web Dispatcher write attacker-controlled data past the memory reserved for the connection. The result is an immediate crash or controlled heap corruption. SAP's kernel is closed source, so no vulnerable function is public; Onapsis described the mechanism in its advisory.

PROXYGATE is a separate kernel flaw in how the gateway applies its proxy access control list. The SAP Gateway starts helper programs and relays RFC connections. Its prxyinfo file lists which sources may open a proxy connection and where those connections may go. When the file is missing, the profile parameter gw/acl_mode_proxy decides the default. It ships set to 0, which allows every proxy connection.

SAP's default access control list also classifies an external attacker as an internal application server. A crafted request therefore passes the "allow internal" rule, and the gateway starts the program the attacker asks for.

The SAML2 flaw is an assertion-verification gap. SAP says the SAML2 Service Provider does not sufficiently verify incoming authentication assertions under certain configurations. An unauthenticated attacker can submit a crafted assertion and receive a session as an arbitrary user, including a privileged one.

How is it exploited?

There is no public proof-of-concept code for ICM2SHELL. Onapsis withheld the technical exploitation details and gave SAP a working end-to-end exploit, so the steps here describe the path its advisory makes public.

1. Reach the HTTP or HTTPS port of the ICM or Web Dispatcher. WebSocket support is enabled by default, even on systems that do not use it.
2. Complete the WebSocket upgrade. Some default ICF services in SAP S/4HANA accept WebSocket connections without authentication.
3. Send a crafted sequence of WebSocket control frames whose size or length fields do not match the data that follows.
4. The reassembly code trusts those values and writes past the buffer reserved for the connection. A malformed sequence crashes the process.
5. Shape the corrupted memory to redirect execution. Onapsis says its exploit runs operating system commands as <sid>adm end to end.

PROXYGATE takes a different route into the same account:

1. Reach a gateway port, 33NN or 48NN, from a network the proxy policy treats as untrusted.
2. Send the crafted proxy request. The faulty classification makes the gateway treat the source as an internal application server.
3. The "allow internal" rule passes, and the gateway starts the program the request names with the privileges of <sid>adm.

The SAML2 flaw needs no command execution:

1. Reach the SAML2 Service Provider endpoint.
2. Submit a crafted authentication assertion under the affected configuration.
3. The service accepts it without sufficient verification and creates a session for the user it names.

How does the attack flow?

A crafted WebSocket reaches the ICM or Web Dispatcher, corrupts its heap and runs commands as <sid>adm. PROXYGATE separately enables OS commands under that account; the SAML2 flaw instead impersonates an SAP application user, including an administrator.

What can an attacker do?

ICM2SHELL gives an unauthenticated attacker with network access the same control as the <sid>adm account that owns the SAP installation.

• Read database credentials and other secrets from the secure store and instance profiles, then read or change business data directly in the database.
• Collect RFC destinations and technical credentials, then move to connected SAP and non-SAP systems.
• Change configuration or binaries and keep persistent access.
• Stop the system or destroy data, which takes the business processes it runs offline.

A single malformed connection can also crash the ICM or Web Dispatcher. While the process restarts, every Fiori app, API and web service it serves is unavailable, and repeated attempts keep it down.

PROXYGATE gives the same command execution as <sid>adm without authentication, but only when the gateway proxy policy is permissive or missing. A restrictive prxyinfo blocks the path from untrusted networks.

The SAML2 flaw gives a session as any SAP user, including an administrator. It depends on the SAML2 configuration SAP describes, and it can extend to connected systems through the impersonated user's authorizations.

Why does the fix work?

SAP's kernel patch closes the validation gap Onapsis describes in the WebSocket reassembly step.

Note 3778530 and Note 3778556 ship the corrected kernel code at the patch levels in the table. The fix covers both the ICM and the Web Dispatcher because they share the code.

Note 3798345 changes the gateway's default proxy behavior and adds gw/acl_mode_proxy. After the note, an operator must set the parameter to 1 so a missing prxyinfo means restrictive instead of allow-all. Note 3849308 adds the missing verification of incoming SAML2 assertions.

SAP publishes no patch diff for these closed-source components, so the fix cannot be checked line by line. Onapsis says the flaw is in the reassembly step, and SAP's notes list the fixed patch levels. Neither vendor publishes the changed code.

How do I check if I was compromised?

Neither SAP nor Onapsis has published indicators of compromise for ICM2SHELL. The following checks look for the crash and restart pattern an attempt leaves, and for the gateway and SAML2 activity the other flaws would produce.

• On each application server and Web Dispatcher, inspect dev_icm and dev_webdisp in /usr/sap/<SID>/<INSTANCE>/work/ for unexpected termination, panic or restart entries outside a maintenance window.
• Compare the process IDs of icman and sapwebdisp with the last planned restart. A change without a patch or restart is a lead.
• Search the ICM or Web Dispatcher HTTP log for status code 101, the WebSocket upgrade. If no application uses WebSocket, any such request deserves a look.
• On gateways, review dev_gwrd and the security audit log for inbound proxy connections from outside the SAP server networks and for helper programs started outside known jobs.
• For SAML2, review logons that have no matching identity-provider authentication event, and new or changed privileged users since November 10, 2026.

An attempt that fails may leave no trace beyond a crash, and a crash can have other causes. Treat these results as leads, not proof.

Timeline

• 2026-11-10: SAP publishes its November security notes, including 3778530, 3778556, 3798345 and 3849308, and the CVE records for all four flaws. Onapsis publishes its ICM2SHELL and PROXYGATE analyses and its patch-day review.
• 2026-11-12: Onapsis updates the ICM2SHELL and PROXYGATE advisories.
• 2026-11-14: No exploitation is reported, CISA's SSVC records still say none, and none of the four CVEs is in the CISA KEV catalog.

FAQ

Is ICM2SHELL exploited in the wild?

No. Onapsis said on November 10 that it had not observed exploitation, CISA's SSVC record says none, and none of the four CVEs is in KEV as of November 14, 2026. The working exploit Onapsis gave SAP is a demonstration, not a public tool.

Does authentication protect an SAP system from ICM2SHELL?

No. The flaw is reachable before authentication, so network access to the HTTP or HTTPS port is enough. Some default ICF services in SAP S/4HANA accept WebSocket connections without authentication.

Is SAP NetWeaver AS Java affected?

No for ICM2SHELL. The flaw is in the ABAP stack's kernel code, and a dual-stack system is affected through that stack. The gateway flaw does affect AS Java systems and standalone gateways.

Is the SAP HANA database affected?

The Web Dispatcher embedded in HANA XS Classic and XS Advanced is affected, and the fixed revisions are 2.00.079.11 and 2.00.089.05. Onapsis does not name the HANA database engine itself as affected.

Can I disable WebSocket instead of patching?

Yes, if no application uses it. Set icm/HTTP/support_websocket_upgrade=FALSE and restart the component. This removes the ICM2SHELL path, but it breaks ABAP Push Channels and some Fiori scenarios, so check the HTTP log for status code 101 first.

Do I need to set anything after applying the notes?

Yes for the gateway. After Note 3798345, set gw/acl_mode_proxy = 1 on kernels that support it, and keep a restrictive prxyinfo file. For ICM2SHELL, the kernel patch is the fix, and the component must be restarted so the patched binary loads.

Find exposed SAP systems with Ostorlab

Inventory the SAP application servers and Web Dispatchers reachable on your network with Ostorlab attack surface discovery. The Basis team then knows which hosts to patch and restart first.

References

• Onapsis Research Labs, "ICM2SHELL (CVE-2026-76964 and CVE-2026-89126): A Critical Pre-Authentication Vulnerability in SAP NetWeaver's ICM and Web Dispatcher", November 10, 2026, updated November 12, 2026: https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/ (checked November 14, 2026)
• Onapsis Research Labs, "PROXYGATE (CVE-2026-89103): A Critical Pre-Authentication Vulnerability in SAP NetWeaver's Gateway", November 10, 2026, updated November 12, 2026: https://onapsis.com/blog/proxygate-cve-2026-89103-sap-netweaver-gateway-threat-advisory/ (checked November 14, 2026)
• Onapsis Research Labs, "SAP Security Notes: November 2026 Patch Day", November 10, 2026, updated November 12, 2026: https://onapsis.com/blog/sap-security-patch-day-nov-2026/ (checked November 14, 2026)
• SAP Security Note 3778530, the ICM fix for CVE-2026-76964: https://me.sap.com/notes/3778530 (checked November 14, 2026)
• SAP Security Note 3778556, the Web Dispatcher fix for CVE-2026-89126: https://me.sap.com/notes/3778556 (checked November 14, 2026)
• SAP FAQ Note 3778788, workarounds for ICM2SHELL: https://me.sap.com/notes/3778788 (checked November 14, 2026)
• SAP Security Note 3798345, the gateway fix for CVE-2026-89103: https://me.sap.com/notes/3798345 (checked November 14, 2026)
• SAP Security Note 3849308, the SAML2 fix for CVE-2026-120017: https://me.sap.com/notes/3849308 (checked November 14, 2026)
• SAP Note 3810197, the downward-compatible upgrade path for out-of-maintenance kernels: https://me.sap.com/notes/3810197 (checked November 14, 2026)
• CVE record for CVE-2026-76964, CVSS v3.1 10.0 published November 10, 2026: https://www.cve.org/CVERecord?id=CVE-2026-76964 (checked November 14, 2026)
• CVE record for CVE-2026-89126, CVSS v3.1 10.0 published November 10, 2026: https://www.cve.org/CVERecord?id=CVE-2026-89126 (checked November 14, 2026)
• CVE record for CVE-2026-89103, CVSS v3.1 10.0 published November 10, 2026: https://www.cve.org/CVERecord?id=CVE-2026-89103 (checked November 14, 2026)
• CVE record for CVE-2026-120017, CVSS v3.1 10.0 published November 10, 2026: https://www.cve.org/CVERecord?id=CVE-2026-120017 (checked November 14, 2026)
• CISA Known Exploited Vulnerabilities catalog, which lists none of the four CVEs: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (checked November 14, 2026, via the catalog's JSON feed)