{"slug":"icm2shell-sap-netweaver-web-dispatcher","title":"ICM2SHELL (CVE-2026-76964, CVE-2026-89126)","shortName":"ICM2SHELL","summary":"Pre-auth memory corruption in SAP Kernel WebSocket fragment reassembly, shared by AS ABAP ICM (CVE-2026-76964) and SAP Web Dispatcher (CVE-2026-89126, including HANA XS Classic and XS Advanced). Onapsis: network access to the HTTP/HTTPS port is enough; WebSocket upgrade is on by default; OS commands run as <sid>adm. SAP CNA CVSS 3.1 10.0 on both. SAP Security Notes 3778530 and 3778556 plus FAQ Note 3778788, SAP Patch Day 10 Nov 2026. Note text is SAP for Me login-only; patch levels and workarounds here come from Onapsis's public summary and SAP's public notes list. Onapsis (10 Nov 2026) has not observed in-the-wild use. Not in CISA KEV (catalog 2026.11.10, checked 10 Nov 2026). Badge: No known ITW. No public PoC indexed.","isExample":false,"draft":false,"family":"icm2shell-sap-netweaver-web-dispatcher","kind":"single-product","aliases":["CVE-2026-76964","CVE-2026-89126","ICM2SHELL","SAP Note 3778530","SAP Note 3778556","SAP Note 3778788","SAP NetWeaver ICM","SAP Web Dispatcher"],"publishedAt":"2026-11-10","updatedAt":"2026-11-10","patchStatus":"patched","exploited":false,"scores":{"cve":"CVE-2026-76964","cvss":{"cve":"CVE-2026-76964","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76964","sourceDate":"2026-11-10","checkedDate":"2026-11-10","dateLabel":"SAP CNA published","sourceLabel":"SAP CNA (CVSS 3.1 10.0, CWE-1287), shown as NVD Primary on 10 Nov 2026 (status Received). Sibling CVE-2026-89126 is the same CNA vector and score (CWE-122). SAP's public November 2026 notes list tags both notes Critical 10.0. NVD HTML detail pages timed out on 10 Nov 2026; NVD API 2.0 returned the CNA metric.","nvdPublishedDate":"2026-11-10"},"epss":{"cve":"CVE-2026-76964","score":0.00431,"percentile":0.37635,"date":"2026-11-10","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-76964","checkedDate":"2026-11-10"},"kev":{"cve":"CVE-2026-76964","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-10"},"addedDate":"2026-11-10"},"priority":{"label":"high"},"managementSummary":{"what":"Pre-auth SAP Kernel WebSocket memory corruption (ICM2SHELL) in AS ABAP ICM (CVE-2026-76964) and SAP Web Dispatcher (CVE-2026-89126, including HANA XS). SAP CNA CVSS 3.1 10.0. Onapsis: HTTP/HTTPS reach is enough; commands run as <sid>adm. No known ITW as of 10 Nov 2026. Not in CISA KEV (catalog 2026.11.10).","action":"Patch internet-facing Web Dispatchers and ICMs first to the Onapsis-listed kernel and Web Dispatcher patch levels (Notes 3778530 and 3778556). Until then, a higher-PL front Web Dispatcher can shield backends reached only through it (not PROT=ROUTER), or set icm/HTTP/support_websocket_upgrade=FALSE (SAP warns this breaks interactive and integration scenarios). See FAQ Note 3778788."},"seenInTheWild":[{"metric":"third-party-stated","value":"No in-the-wild exploitation observed as of 10 Nov 2026","observer":"Onapsis Research Labs","date":"2026-11-10","method":"Onapsis (Pablo Artuso, 10 Nov 2026): the Onapsis Research Labs have not observed active in-the-wild exploitation and continue to monitor. That is a 10 Nov check, not a first-seen exploitation day. Badge: No known ITW. Never a not-exploited mark.","sourceUrl":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/"}],"seenInTheWildLinks":[{"title":"ICM2SHELL (CVE-2026-76964 and CVE-2026-89126): A Critical Pre-Authentication Vulnerability in SAP NetWeaver's ICM and Web Dispatcher","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","observer":"Onapsis","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-10","items":[{"text":"New catalog page for ICM2SHELL, the shared SAP Kernel WebSocket memory-corruption bug tracked as CVE-2026-76964 (ICM) and CVE-2026-89126 (Web Dispatcher).","headline":"New catalog page for ICM2SHELL CVE-2026-76964 and CVE-2026-89126","section":"overview","date":"2026-11-10","kind":"page"},{"text":"SAP Patch Day 10 Nov 2026 published Note 3778530 (CVE-2026-76964, ICM) and Note 3778556 (CVE-2026-89126, Web Dispatcher), both Critical CVSS 10.0 on SAP's public notes list, plus FAQ Note 3778788. Onapsis published the ICM2SHELL advisory the same day with fixed kernel and Web Dispatcher patch levels. SAP note bodies are SAP for Me login-only; this page uses Onapsis's public table and SAP's public notes list.","headline":"SAP Patch Day notes 3778530 and 3778556; Onapsis lists fixed patch levels","section":"fixed-versions","date":"2026-11-10","sourceUrl":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html","alsoSourceUrl":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/"},{"text":"Onapsis (10 Nov 2026): the Onapsis Research Labs have not observed active in-the-wild exploitation. CISA ADP SSVC on CVE-2026-89126 is Exploitation none (timestamp 2026-11-10T20:37:50.308296Z). Badge: No known ITW. Never a not-exploited mark. Not in CISA KEV (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries, checked 10 Nov 2026). No public PoC indexed; Onapsis withheld exploitation details.","headline":"No known ITW as of 10 Nov; not in CISA KEV (catalog 2026.11.10)","section":"exploitation","date":"2026-11-10","sourceUrl":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","alsoSourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},"whatTheBugIs":"ICM2SHELL is Onapsis Research Labs' name for one memory-corruption bug in SAP Kernel WebSocket fragment reassembly. Because ICM and SAP Web Dispatcher share that code, SAP issued two notes on Patch Day 10 Nov 2026: Note 3778530 (CVE-2026-76964, AS ABAP Internet Communication Manager) and Note 3778556 (CVE-2026-89126, SAP Web Dispatcher, including the dispatcher embedded in SAP HANA XS). FAQ Note 3778788 covers both. SAP's public November 2026 notes list tags both security notes Critical, CVSS 10.0. The note bodies are SAP for Me login-only. Patch levels, preconditions, workarounds, and not-affected products on this page come from Onapsis's public ICM2SHELL advisory (Pablo Artuso, 10 Nov 2026) and Onapsis's Patch Day roundup, cross-checked against SAP's public notes list and the SAP CNA CVE records.\n\nSAP CNA published CVE-2026-76964 at 2026-11-10T00:17:07.116Z (reserved 2026-08-20T05:15:36.823Z). Title: Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager). CWE-1287 Improper Validation of Specified Type of Input. CVSS 3.1 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). CNA description: SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition. Successful exploitation could allow arbitrary code execution and full compromise. Affected versions object: KRNL64UC 7.53, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.20. defaultStatus unaffected.\n\nSAP CNA published CVE-2026-89126 at 2026-11-10T00:34:43.805Z (reserved 2026-09-10T22:26:03.939Z; record updated 2026-11-10T20:38:17.931Z). Title: Memory Corruption vulnerability in SAP Web Dispatcher. CWE-122 Heap-based Buffer Overflow. Same CVSS 3.1 10.0 vector. Same unauthenticated memory-corruption description, aimed at SAP Web Dispatcher. Affected versions object includes HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, KERNEL 7.53, 9.18, 9.20. CISA ADP SSVC on this CVE: Exploitation none, Automatable yes, Technical Impact total (timestamp 2026-11-10T20:37:50.308296Z). No ADP container was present on the CVE-2026-76964 record fetched 10 Nov 2026. FIRST EPSS on 10 Nov 2026: CVE-2026-76964 0.00431 (37.635th percentile); CVE-2026-89126 0.00431 (37.636th percentile). NVD HTML detail pages timed out on 10 Nov 2026.\n\nOnapsis: the Internet Communication Manager receives HTTP, HTTPS, and WebSocket traffic for an SAP system. SAP Web Dispatcher is a reverse proxy built on the same code base and often faces the internet. Large WebSocket messages can be split into fragments; the receiver puts them back together. ICM2SHELL lives in that reassembly step. A crafted sequence of WebSocket messages makes ICM or Web Dispatcher write past the memory reserved for the connection. Depending on how that data is shaped, the result is an immediate crash or controlled corruption that an attacker can turn into operating system commands as <sid>adm, the account that owns the SAP installation. Onapsis says this is not theoretical: the labs gave SAP a working exploit that achieves full unauthenticated remote code execution end to end as <sid>adm. The denial-of-service crash reproduced on every SAP Kernel release tested. This page does not describe payloads, frame layout, or reproduction steps. Onapsis withheld those details.\n\nPreconditions (Onapsis): network access to the HTTP/HTTPS port; WebSocket support enabled by default whether or not any application uses it; some services, including default ICF services in SAP S/4HANA, accept WebSocket connections without authentication; in others the flaw can be reached before authentication. No SAP user, password, or certificate is required. Web Dispatcher reassembles messages itself, so the edge proxy is in scope on its own. Exposure is determined by kernel release and patch level, not by the application release. It applies to any SAP NetWeaver AS ABAP system running kernel 7.40 or higher and to any Web Dispatcher, including the one embedded in SAP HANA XS. Dual-stack installations are in scope because of their ABAP stack.\n\nOnapsis (10 Nov 2026): the Onapsis Research Labs have not observed active in-the-wild exploitation. Badge: No known ITW. Not in CISA KEV (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries, checked 10 Nov 2026). No public PoC indexed.\n\nRelated same Patch Day, not this bug: PROXYGATE CVE-2026-89103 is a separate SAP Gateway issue (Note 3798345, CVSS 10.0 on SAP's public list). Onapsis's PROXYGATE advisory is a one-line pointer only.\n\nCredit: Onapsis Research Labs. Advisory byline Pablo Artuso, 10 Nov 2026.","attackPath":{"caption":"High-level only. Not a reproduction guide. Onapsis withheld exploitation details. No payloads, frame layout, or usage steps.","steps":[{"id":"reach","label":"HTTP or HTTPS reach","detail":"Network access to the ICM or Web Dispatcher HTTP/HTTPS port. Onapsis: no SAP user, password, or certificate is required."},{"id":"unsafe","label":"WebSocket upgrade","detail":"WebSocket support is on by default even if unused. Some default S/4HANA ICF services accept WebSocket without authentication. Conceptual only."},{"id":"exec","label":"Fragment reassembly corruption","detail":"Onapsis: a crafted WebSocket message sequence corrupts kernel reassembly memory. Result is a crash or controlled corruption. No frame detail on this page."},{"id":"shell","label":"Commands as <sid>adm","detail":"Onapsis: OS commands as <sid>adm, the SAP installation owner, or a reliable process crash (DoS) on every kernel release tested."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-10","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 10 Nov 2026) against catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries). CVE-2026-76964 and CVE-2026-89126 have no catalog rows. CISA ADP SSVC on CVE-2026-89126: Exploitation none (timestamp 2026-11-10T20:37:50.308296Z)."},"firstSeen":{"date":null,"source":"Onapsis Research Labs (Pablo Artuso, 10 Nov 2026). CISA ADP SSVC on CVE-2026-89126 (Exploitation none, 2026-11-10T20:37:50.308296Z).","note":"Onapsis: the Onapsis Research Labs have not observed active in-the-wild exploitation as of 10 Nov 2026 and continue to monitor. CISA ADP SSVC Exploitation is none on CVE-2026-89126. First public CVE records 10 Nov 2026. Badge: No known ITW. Never a not-exploited mark."},"vendorStatements":[{"vendor":"SAP","date":"2026-11-10","statement":"On 10 November 2026 SAP Security Patch Day released Note 3778530 [CVE-2026-76964] Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager), Critical, CVSS 10.0, and Note 3778556 [CVE-2026-89126] Memory Corruption vulnerability in SAP Web Dispatcher, Critical, CVSS 10.0. SAP strongly recommends that customers apply patches on priority. Note bodies are SAP for Me login-only.","url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html","retracted":false},{"vendor":"SAP CNA","date":"2026-11-10","statement":"An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-76964","retracted":false}]},"timeline":[{"date":"2026-08-20T05:15:36.823Z","event":"CVE-2026-76964 reserved by SAP CNA.","source":{"title":"CVE-2026-76964","url":"https://cveawg.mitre.org/api/cve/CVE-2026-76964","publisher":"SAP CNA / CVE.org"},"kind":"other","addedDate":"2026-11-10"},{"date":"2026-09-10T22:26:03.939Z","event":"CVE-2026-89126 reserved by SAP CNA.","source":{"title":"CVE-2026-89126","url":"https://cveawg.mitre.org/api/cve/CVE-2026-89126","publisher":"SAP CNA / CVE.org"},"kind":"other","addedDate":"2026-11-10"},{"date":"2026-11-10T00:17:07.116Z","event":"SAP CNA published CVE-2026-76964. CVSS 3.1 10.0. CWE-1287. References Note 3778530 and SAP Security Patch Day.","source":{"title":"CVE-2026-76964","url":"https://cveawg.mitre.org/api/cve/CVE-2026-76964","publisher":"SAP CNA / CVE.org"},"kind":"advisory","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-10T00:34:43.805Z","event":"SAP CNA published CVE-2026-89126. CVSS 3.1 10.0. CWE-122. References Note 3778556 and SAP Security Patch Day.","source":{"title":"CVE-2026-89126","url":"https://cveawg.mitre.org/api/cve/CVE-2026-89126","publisher":"SAP CNA / CVE.org"},"kind":"advisory","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-10","event":"SAP Security Patch Day November 2026. 35 new notes and 4 GitHub advisories. Note 3778530 (CVE-2026-76964, ICM) and Note 3778556 (CVE-2026-89126, Web Dispatcher) both Critical CVSS 10.0. FAQ Note 3778788 is named by Onapsis; it is not a row on the public notes table.","source":{"title":"SAP Security Patch Day - November 2026","url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html","publisher":"SAP"},"kind":"patch","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-10","event":"Onapsis Research Labs (Pablo Artuso) published the ICM2SHELL threat advisory. Shared WebSocket reassembly bug in ICM and Web Dispatcher. Working unauthenticated exploit given to SAP. No in-the-wild use observed. Technical exploitation details withheld.","source":{"title":"ICM2SHELL (CVE-2026-76964 and CVE-2026-89126)","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","publisher":"Onapsis"},"kind":"advisory","key":true,"addedDate":"2026-11-10"},{"date":"2026-11-10","event":"Onapsis Patch Day roundup: Note 3778556 also covers the Web Dispatcher in HANA XS Classic and XS Advanced. Quote: SAP Content Server is not affected.","source":{"title":"SAP Security Patch Day for November 2026","url":"https://onapsis.com/blog/sap-security-patch-day-nov-2026/","publisher":"Onapsis"},"kind":"advisory","addedDate":"2026-11-10"},{"date":"2026-11-10","event":"SecurityWeek (Ionut Arghire, 9:46 AM ET) covers ICM2SHELL and PROXYGATE from SAP's November notes and the Onapsis advisory.","source":{"title":"SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities","url":"https://www.securityweek.com/sap-patches-critical-icm2shell-proxygate-vulnerabilities/","publisher":"SecurityWeek"},"kind":"other","addedDate":"2026-11-10"},{"date":"2026-11-10","event":"The Hacker News (Swati Khandelwal) covers four CVSS 10.0 SAP notes, including CVE-2026-76964 and CVE-2026-89126, and names Onapsis as the researcher. Updated later the same day with researcher detail.","source":{"title":"SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution","url":"https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html","publisher":"The Hacker News"},"kind":"other","addedDate":"2026-11-10"},{"date":"2026-11-10T20:37:50.308296Z","event":"CISA ADP SSVC on CVE-2026-89126: Exploitation none, Automatable yes, Technical Impact total.","source":{"title":"CVE-2026-89126","url":"https://cveawg.mitre.org/api/cve/CVE-2026-89126","publisher":"CISA ADP"},"kind":"other","addedDate":"2026-11-10"},{"date":"2026-11-10","event":"Not in CISA KEV. Catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries. CVE-2026-76964 and CVE-2026-89126 have no catalog rows.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","key":true,"addedDate":"2026-11-10"}],"openNotes":[{"title":"SAP note bodies are login-only","detail":"Notes 3778530, 3778556, 3778788, and Private Cloud FAQ 3849055 require SAP for Me sign-in. This page does not treat those note bodies as verified. Patch levels, workarounds, and not-affected products are taken from Onapsis's public ICM2SHELL advisory and Patch Day roundup, then checked against SAP's public November 2026 notes list and the SAP CNA CVE records.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"},{"url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html","date":"2026-11-10","publisher":"SAP"}]},{"title":"Onapsis withheld exploitation details","detail":"Onapsis says the labs gave SAP a working unauthenticated exploit and that this post omits technical exploitation details. This page does not add frame layout, payloads, or usage steps from third-party note recaps.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"title":"Kernel 7.93 patch-level trap","detail":"Onapsis (FAQ #6 in Note 3778788): a higher 7.93 patch level is not always a fixed one. PL 419 is still affected. Only the updated PL 401 Stack Kernel, PL 402 once released, and PL 420 or higher include the fix. PL 402 was not released as of the 10 Nov 2026 Onapsis post.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"title":"RISE / Private Cloud FAQ is login-only","detail":"Onapsis: customers running SAP systems in SAP's Private Cloud (for example under RISE with SAP) should review SAP Note 3849055. We could not read that note.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"title":"Same Patch Day, different bug: PROXYGATE CVE-2026-89103","detail":"SAP Note 3798345 [CVE-2026-89103] Broken Access Control in SAP Gateway is a separate CVSS 10.0 issue on the same Patch Day. Onapsis names it PROXYGATE. It is not ICM2SHELL and has no section on this page.","sources":[{"url":"https://onapsis.com/blog/proxygate-cve-2026-89103-sap-netweaver-gateway-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"},{"url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html","date":"2026-11-10","publisher":"SAP"}]},{"title":"BleepingComputer article was not readable","detail":"https://www.bleepingcomputer.com/news/security/sap-patches-four-maximum-severity-security-vulnerabilities/ returned HTTP 403 when fetched on 10 Nov 2026. This page does not cite it.","sources":[{"url":"https://www.bleepingcomputer.com/news/security/sap-patches-four-maximum-severity-security-vulnerabilities/","date":"2026-11-10","publisher":"BleepingComputer"}]}],"defenderActions":[{"title":"Patch internet-facing Web Dispatchers and ICMs first","detail":"Onapsis: applying Notes 3778530 and 3778556 is the only complete fix. Patch internet-facing Web Dispatchers and ICMs first. A compromised Web Dispatcher sits in front of every system it routes to. Apply the latest available patch for the release; listed patch levels may no longer be available for download. Check every application server and every Web Dispatcher, including standalone and HANA XS-embedded instances.","priority":"now","links":[{"label":"Onapsis ICM2SHELL advisory","href":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/"},{"label":"SAP Security Patch Day November 2026","href":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html"}]},{"title":"Use a higher-PL Web Dispatcher as a temporary shield where you cannot patch yet","detail":"Onapsis, citing FAQ Note 3778788: a Web Dispatcher on 7.53 PL 1629, 7.54 PL 723, 7.93 PL 430, 9.16 PL 200 or higher can protect backends reached exclusively through it. It does not work with icm/server_port_ PROT=ROUTER, and it does not protect a backend that is also reachable directly.","priority":"now","links":[{"label":"Onapsis ICM2SHELL advisory","href":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/"}]},{"title":"Disable WebSocket upgrade only after checking HTTP 101 use","detail":"Onapsis, citing FAQ Note 3778788: icm/HTTP/support_websocket_upgrade=FALSE and a restart removes the vulnerability. SAP warns of significant impact on interactive and integration scenarios. Check for HTTP 101 in the ICM/Web Dispatcher HTTP log before disabling. Not using WebSocket does not make a system safe until support is disabled or the patch is applied.","priority":"soon","links":[{"label":"Onapsis ICM2SHELL advisory","href":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/"}]},{"title":"Narrow HTTP/HTTPS access and watch for unexpected ICM or Web Dispatcher restarts","detail":"Onapsis: restrict HTTP/HTTPS ports to networks that need them. This does not fix the bug. Unexpected restarts in dev_icm or dev_webdisp, and icman or Web Dispatcher PID changes outside maintenance, deserve investigation.","priority":"now","links":[{"label":"Onapsis ICM2SHELL advisory","href":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/"}]}],"detection":[{"title":"Unexpected ICM or Web Dispatcher restarts","detail":"Onapsis: every exploitation attempt is likely to crash the ICM or Web Dispatcher at least once. Hunt unexpected restarts in dev_icm or dev_webdisp in the work directory. A restart is a lead, not proof of code execution, and not a signature or IOC.","logSource":"dev_icm / dev_webdisp traces in the SAP work directory","kind":"generic","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","described":true},{"title":"icman or Web Dispatcher PID changes outside maintenance","detail":"Onapsis: changes in the process ID of icman or the Web Dispatcher outside planned maintenance deserve investigation. A PID change is a lead, not proof of this CVE.","logSource":"Host process inventory for icman / sapwebdisp (OS pid table or SAP instance snapshot)","kind":"generic","group":"edr","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","described":true},{"title":"WebSocket upgrades (HTTP 101) in ICM or Web Dispatcher HTTP logs","detail":"Onapsis: look for requests with status code 101 in the ICM/Web Dispatcher HTTP log to see whether WebSocket is in use before considering the disable-WebSocket workaround. This log is on by default in release 7.73 and higher and in XS Advanced; it must be enabled on 7.54 and lower and on XS Classic (FAQ #15.1). HTTP 101 can be legitimate. Presence does not prove exploitation. Absence does not mean the system is safe.","logSource":"ICM / Web Dispatcher HTTP log (status 101). Default on from 7.73 and XS Advanced; must be enabled on 7.54 and lower and XS Classic","kind":"generic","group":"web-proxy","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","described":true}],"detectionRules":[],"detectionLinks":[],"retrohunt":{"summary":"From 10 Nov 2026 public disclosure, hunt unexpected ICM and Web Dispatcher restarts in dev_icm / dev_webdisp, icman or sapwebdisp PID changes outside maintenance, and HTTP 101 WebSocket upgrades in the ICM/Web Dispatcher HTTP log. Onapsis has not observed in-the-wild use. A hit is a lead, not proof of code execution.","lookback":{"from":"2026-11-10","basis":"public-disclosure","rationale":"Onapsis published the ICM2SHELL advisory and SAP published the CVE records and Patch Day notes on 10 Nov 2026. Hunt from that day. No earlier public hunting window was published. Onapsis says attempts are likely to crash ICM or Web Dispatcher at least once.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},"logSources":[{"name":"dev_icm and dev_webdisp in the SAP work directory","why":"Onapsis: unexpected restarts are recorded there.","required":true},{"name":"Host process inventory for icman and the Web Dispatcher","why":"Onapsis: PID changes outside planned maintenance deserve investigation.","required":true},{"name":"ICM / Web Dispatcher HTTP log","why":"Onapsis: HTTP 101 shows WebSocket upgrades. Default on from 7.73 and XS Advanced; must be enabled on 7.54 and lower and XS Classic.","required":false}],"steps":[{"title":"List unexpected ICM and Web Dispatcher restarts from 10 Nov 2026","detail":"Search dev_icm and dev_webdisp for restarts outside planned maintenance. Onapsis: every exploitation attempt is likely to crash the process at least once. A restart is a lead, not proof. Do not send crafted WebSocket traffic.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"title":"Compare icman and Web Dispatcher PIDs to the maintenance calendar","detail":"Record PID changes for icman and the Web Dispatcher from 10 Nov 2026. Onapsis: changes outside planned maintenance deserve investigation.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"title":"List HTTP 101 WebSocket upgrades in the HTTP log","detail":"Onapsis: status 101 shows WebSocket use. Enable the HTTP log first on 7.54 and lower and on XS Classic if it is off. HTTP 101 can be legitimate. Absence does not mean the host is safe.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]}],"queries":[],"artefacts":[{"kind":"device-log","value":"Unexpected restart in dev_icm or dev_webdisp","detail":"Onapsis hunting pointer. A restart is not proof of code execution.","sourceUrl":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","sourceDate":"2026-11-10"},{"kind":"process","value":"icman or Web Dispatcher PID change outside maintenance","detail":"Onapsis hunting pointer. Presence is a lead.","sourceUrl":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","sourceDate":"2026-11-10"},{"kind":"web-log","value":"HTTP 101 WebSocket upgrade","detail":"Onapsis: used to see whether WebSocket is in use. Legitimate Fiori and integration traffic can produce 101. Not an exploitation signature.","sourceUrl":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","sourceDate":"2026-11-10"}],"iocNote":"No published attacker IPs, hashes, domains, or user-agents as of 10 Nov 2026. Do not invent IOCs.","hitMeaning":[{"level":"attempt","detail":"Unexpected ICM or Web Dispatcher restart, or a PID change outside maintenance, with no other evidence that commands ran as <sid>adm."},{"level":"likely-compromise","detail":"Those restarts plus unexpected children, configuration or binary changes, or secure-store access by <sid>adm on a host below a listed fixed patch level that was reachable from 10 Nov 2026. Onapsis describes those outcomes as what <sid>adm can do after code execution; they are not observed in-the-wild artefacts."},{"level":"compromise","detail":"Evidence that attacker-controlled operating system commands ran as <sid>adm. Onapsis has not published in-the-wild IOCs or a persistence list. Independent validation: not verified.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Patch internet-facing Web Dispatchers and ICMs","detail":"Onapsis: Notes 3778530 and 3778556 are the only complete fix. Patch edge Web Dispatchers first.","links":[{"label":"Onapsis ICM2SHELL advisory","href":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/"}]},{"title":"Preserve work-directory traces and HTTP logs before restart or kernel swap","detail":"Keep copies of dev_icm, dev_webdisp, HTTP logs, and instance PID history from 10 Nov 2026 onward.","links":[{"label":"Onapsis ICM2SHELL advisory","href":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/"}]}],"limits":["Onapsis has not observed in-the-wild use as of 10 Nov 2026.","No published attacker IPs are copied here.","A process restart or HTTP 101 is not proof of compromise.","HTTP log is off by default on 7.54 and lower and on XS Classic until enabled.","No public Nuclei or Sigma rule was found as of 10 Nov 2026.","First calendar day of successful compromise: not verified."],"sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}],"updatedAt":"2026-11-10"},"amIAffected":{"summary":"Any SAP NetWeaver AS ABAP kernel 7.40 or higher, any Web Dispatcher (standalone or embedded in HANA XS Classic / XS Advanced), and dual-stack systems via their ABAP stack. Preconditions: network access to the HTTP/HTTPS port; WebSocket upgrade on by default. Compare kernel and Web Dispatcher patch levels to the Onapsis table. Do not send a WebSocket test.","checks":[{"id":"v2s-aia-icm2shell-sap-netweaver-web-dispatcher-version-1","kind":"version","title":"Record kernel release and patch level on every application server","detail":"Onapsis: exposure is determined by the SAP Kernel, not the application release. Record release and patch level and compare them to the fixed patch levels in the Onapsis table. For 7.93, PL 419 is still affected. Do not send crafted WebSocket traffic.","command":"On each application server, record the SAP Kernel release and patch level from transaction SM51 (RedRays, citing Note 3778530) or the equivalent instance snapshot, then compare it to the Onapsis fixed patch levels for that release.","affectedMeans":"The kernel is 7.40 or higher and below the Onapsis fixed patch level for that release, or it is 7.93 PL 419, or it is an out-of-maintenance 7.40 / 7.41 / 7.42 / 7.45 / 7.49 / 7.73 / 7.81 / 7.85 / 7.89 kernel.","fixedMeans":"The kernel is on or above the Onapsis fixed patch level for that release (7.53 PL 1616/1617, 7.54 PL 710, 7.77 PL 914, 7.93 updated stack kernel PL 401 or PL 420+, 9.16 PL 111, 9.18 PL 37, 9.20 PL 11/13), or the host is kernel 7.22, or AS Java alone with no ABAP stack.","notes":"Onapsis: apply the latest available patch; listed patch levels may no longer be available for download. Check every application server, not only the primary instance. SM51 is a RedRays example from the login-only note recap; Onapsis does not name the transaction.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"},{"url":"https://redrays.io/blog/sap-note-3778530-icm-websocket-memory-corruption-cve-2026-76964/","date":"2026-11-10","publisher":"RedRays"}]},{"id":"v2s-aia-icm2shell-sap-netweaver-web-dispatcher-version-2","kind":"version","title":"Record every Web Dispatcher patch level, including HANA XS","detail":"Onapsis: check the Web Dispatcher separately; it is affected on its own. Include standalone dispatchers and the dispatcher embedded in HANA XS Classic and XS Advanced. RedRays: verify patch level on the admin page or in the startup log.","command":"For each Web Dispatcher, including HANA XS Classic and XS Advanced, record the release and patch level from the Web Dispatcher admin page or the startup log (RedRays, citing Note 3778556), then compare it to the Onapsis fixed patch levels.","affectedMeans":"A Web Dispatcher is below the Onapsis fixed patch level for its release, or HANA 2.0 XS Classic is below 2.00.079.11 / 2.00.089.05, or XS Advanced Runtime 1 is below SP05 Patch 4.","fixedMeans":"Every Web Dispatcher is on a listed fixed patch level, or the landscape has no Web Dispatcher and the ABAP kernel is on a listed fixed patch level.","notes":"Onapsis: a single missed Web Dispatcher leaves the flaw open. Content Server is not affected (Onapsis Patch Day roundup). Do not send a WebSocket test.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"},{"url":"https://onapsis.com/blog/sap-security-patch-day-nov-2026/","date":"2026-11-10","publisher":"Onapsis"},{"url":"https://redrays.io/blog/sap-note-3778556-web-dispatcher-websocket-memory-corruption-cve-2026-89126/","date":"2026-11-10","publisher":"RedRays"}]},{"id":"v2s-aia-icm2shell-sap-netweaver-web-dispatcher-config-1","kind":"config","title":"Record who can reach ICM and Web Dispatcher HTTP/HTTPS ports","detail":"Onapsis: an attacker only needs network access to the HTTP/HTTPS port. Record listener addresses and whether networks other than trusted admin or user networks can complete a connection. Do not authenticate or send a WebSocket upgrade as a test.","command":"Record the ICM and Web Dispatcher HTTP/HTTPS listener addresses, reverse-proxy ACLs, and edge rules, and whether any non-trusted network can complete a TCP connection to those ports.","affectedMeans":"A host is below a listed fixed patch level and its HTTP/HTTPS port is reachable from a network that is not a trusted admin or intended user network.","fixedMeans":"Only trusted networks can reach those ports (workaround), or every ICM and Web Dispatcher is on a listed fixed patch level.","notes":"Network limits are a workaround, not a software fix. Still patch. No sourced Shodan or Censys fingerprint. Do not invent a banner.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"id":"v2s-aia-icm2shell-sap-netweaver-web-dispatcher-config-2","kind":"config","title":"Record icm/HTTP/support_websocket_upgrade and whether HTTP 101 is in use","detail":"Onapsis: WebSocket support is on by default even if unused. Not using WebSocket does not make a system safe until support is disabled or the patch is applied. Record the parameter and, if you might disable it, whether HTTP 101 appears in the HTTP log.","command":"Record icm/HTTP/support_websocket_upgrade for AS ABAP, standalone Web Dispatcher, HANA XS Classic, and XS Advanced (Onapsis: the exact location differs; see FAQ #15.2 in Note 3778788). Separately record whether the HTTP log shows status 101.","affectedMeans":"The parameter is not FALSE (Onapsis: WebSocket support is enabled by default) and the kernel or Web Dispatcher is below a listed fixed patch level.","fixedMeans":"The component is on a listed fixed patch level, or icm/HTTP/support_websocket_upgrade is FALSE and the component was restarted (workaround only).","notes":"HTTP 101 is a use check for the workaround, not a safe/unsafe mark. Absence of 101 does not mean the host is out of scope.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]}],"limits":["No sourced Shodan or Censys fingerprint. Do not invent a port or banner.","Do not send a crafted WebSocket upgrade or fragment sequence as a test.","SAP note bodies are login-only; patch levels come from Onapsis's public table.","Not using WebSocket does not take a system out of scope.","Kernel 7.22 and AS Java alone are out of scope per Onapsis. Dual-stack stays in scope."],"sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"},{"url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html","date":"2026-11-10","publisher":"SAP"}],"updatedAt":"2026-11-10","addedDate":"2026-11-10"},"mitigations":{"summary":"Onapsis, citing SAP FAQ Note 3778788: two temporary workarounds until Notes 3778530 and 3778556 are applied. A higher-PL front Web Dispatcher can shield backends reached only through it (not PROT=ROUTER). Disabling WebSocket upgrade removes the bug but SAP warns it breaks interactive and integration scenarios. Neither replaces the patch.","items":[{"title":"Front Web Dispatcher on a higher patch level as a shield","detail":"Onapsis, FAQ #14: a Web Dispatcher updated to 7.53 PL 1629, 7.54 PL 723, 7.93 PL 430, 9.16 PL 200 or higher can protect the backends behind it. Those patch levels are higher than the security-note fixes because the workaround needs additional corrections.","limits":"Protects only backends accessed exclusively through that Web Dispatcher. Direct reach to a backend is not protected. Does not work if the Web Dispatcher is configured with icm/server_port_ = PROT=ROUTER. Not a substitute for patching the backends.","verify":"Confirm the front Web Dispatcher release and patch level is 7.53 PL 1629, 7.54 PL 723, 7.93 PL 430, 9.16 PL 200 or higher, that PROT=ROUTER is not set on its server ports, and that no client can reach backend ICM HTTP/HTTPS ports except through that dispatcher. Re-check after the next change window. Do not send a WebSocket test.","source":{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}},{"title":"Disable WebSocket support (icm/HTTP/support_websocket_upgrade=FALSE)","detail":"Onapsis, FAQ #15: setting icm/HTTP/support_websocket_upgrade=FALSE and restarting the component removes the vulnerability. Check HTTP 101 in the ICM/Web Dispatcher HTTP log first. That log is on by default in 7.73 and higher and in XS Advanced; enable it on 7.54 and lower and on XS Classic.","limits":"SAP warns that disabling WebSocket has a significant impact on interactive and integration scenarios. Not using WebSocket today does not make a system safe until this parameter is FALSE or the patch is applied. Exact parameter location differs for AS ABAP, standalone Web Dispatcher, HANA XS Classic, and XS Advanced (FAQ #15.2). Temporary; still patch.","verify":"icm/HTTP/support_websocket_upgrade is FALSE on each ICM and Web Dispatcher, the component has been restarted, and HTTP 101 is absent after the change if the HTTP log is on. Confirm in the instance profile or the XS equivalent named in FAQ #15.2. Re-check after the next change window.","source":{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}}],"updatedAt":"2026-11-10","addedDate":"2026-11-10"},"response":{"summary":"If an ICM or Web Dispatcher HTTP/HTTPS port was reachable while below a listed fixed patch level, treat it as exposed. Patch internet-facing dispatchers first, apply a FAQ 3778788 workaround where you cannot patch yet, and review work-directory traces, PIDs, and HTTP logs from 10 Nov 2026. Onapsis describes what <sid>adm can do after code execution; that is impact, not observed in-the-wild persistence. No sourced IOCs were published.","containment":[{"title":"Patch internet-facing Web Dispatchers and ICMs","detail":"Onapsis: applying Notes 3778530 and 3778556 is the only complete fix. Patch edge components first.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"title":"Apply a FAQ 3778788 workaround where you cannot patch yet","detail":"Higher-PL front Web Dispatcher shield (not PROT=ROUTER, backends reached only through it) or icm/HTTP/support_websocket_upgrade=FALSE. Both are temporary.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"title":"Restrict HTTP/HTTPS ports and review traces","detail":"Onapsis: restrict the HTTP/HTTPS ports to networks that need them, and investigate unexpected restarts in dev_icm or dev_webdisp and icman or Web Dispatcher PID changes outside maintenance.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]}],"rotate":[{"item":"Database credentials and other secrets in the SAP secure store and instance profiles","reason":"Onapsis: <sid>adm owns the installation, including the secure store and profiles, and can recover database credentials and other secrets. Rotate those secrets on hosts that were reachable while unpatched if compromise is suspected. Generic IR; Onapsis has not published a credential list from in-the-wild use.","generic":true,"sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"item":"RFC destinations and technical credentials reachable from the host","reason":"Onapsis: <sid>adm can collect RFC destinations and technical credentials that let an attacker move on to connected SAP and non-SAP systems. Rotate those if compromise is suspected. Generic IR.","generic":true,"sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]}],"observedBehaviour":[{"title":"Reliable ICM or Web Dispatcher crash (DoS)","detail":"Onapsis: the same flaw reliably crashes the ICM/Web Dispatcher process with a single connection on every release tested. The process restarts, but repeating the attack keeps it down. This is lab-reproduced impact, not an in-the-wild observation.","sourceUrl":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","sourceDate":"2026-11-10"}],"evidence":[{"title":"Kernel and Web Dispatcher patch levels from before the upgrade","detail":"Keep SM51 output, Web Dispatcher admin or startup-log patch levels, and HANA XS revision strings so you can show whether the host was below a listed fixed patch level while reachable.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"title":"dev_icm / dev_webdisp traces and HTTP logs covering 10 Nov 2026 onward","detail":"Keep work-directory traces and HTTP logs (status 101 and restarts) from the exposure window. A hit is a lead, not proof.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]},{"title":"icman and Web Dispatcher PID history","detail":"Keep process ID history outside planned maintenance. Onapsis: those changes deserve investigation.","sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"}]}],"limits":["No sourced in-the-wild persistence paths or IOCs were published.","Onapsis has not observed in-the-wild use as of 10 Nov 2026.","A process restart or HTTP 101 is not proof of compromise.","Onapsis withheld exploitation details; this page does not reconstruct them."],"sources":[{"url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","publisher":"Onapsis"},{"url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html","date":"2026-11-10","publisher":"SAP"}],"updatedAt":"2026-11-10","addedDate":"2026-11-10"},"bulletins":[{"vendor":"SAP","title":"[CVE-2026-76964] Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)","url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html","date":"2026-11-10","cve":"CVE-2026-76964"},{"vendor":"SAP","title":"[CVE-2026-89126] Memory Corruption vulnerability in SAP Web Dispatcher","url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html","date":"2026-11-10","cve":"CVE-2026-89126"}],"coverage":[{"title":"SAP Security Patch Day - November 2026","publisher":"SAP","url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html","date":"2026-11-10","type":"vendor","addedDate":"2026-11-10"},{"title":"ICM2SHELL (CVE-2026-76964 and CVE-2026-89126): A Critical Pre-Authentication Vulnerability in SAP NetWeaver's ICM and Web Dispatcher","publisher":"Onapsis (Pablo Artuso)","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","date":"2026-11-10","type":"research","addedDate":"2026-11-10"},{"title":"SAP Security Patch Day for November 2026","publisher":"Onapsis","url":"https://onapsis.com/blog/sap-security-patch-day-nov-2026/","date":"2026-11-10","type":"research","addedDate":"2026-11-10"},{"title":"CVE-2026-76964","publisher":"SAP CNA / CVE.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-76964","date":"2026-11-10","type":"government","addedDate":"2026-11-10"},{"title":"CVE-2026-89126","publisher":"SAP CNA / CVE.org","url":"https://www.cve.org/CVERecord?id=CVE-2026-89126","date":"2026-11-10","type":"government","addedDate":"2026-11-10"},{"title":"SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities","publisher":"SecurityWeek","url":"https://www.securityweek.com/sap-patches-critical-icm2shell-proxygate-vulnerabilities/","date":"2026-11-10","type":"news","addedDate":"2026-11-10"},{"title":"SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution","publisher":"The Hacker News","url":"https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html","date":"2026-11-10","type":"news","addedDate":"2026-11-10"},{"title":"CISA KEV catalog JSON (CVE-2026-76964 and CVE-2026-89126 not listed; catalog 2026.11.10)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-10","type":"government","addedDate":"2026-11-10"},{"title":"SAP Note 3778530: ICM WebSocket Memory Corruption (CVE-2026-76964)","publisher":"RedRays","url":"https://redrays.io/blog/sap-note-3778530-icm-websocket-memory-corruption-cve-2026-76964/","date":"2026-11-10","type":"news","addedDate":"2026-11-10"},{"title":"SAP Note 3778556: Web Dispatcher WebSocket Memory Corruption (CVE-2026-89126)","publisher":"RedRays","url":"https://redrays.io/blog/sap-note-3778556-web-dispatcher-websocket-memory-corruption-cve-2026-89126/","date":"2026-11-10","type":"news","addedDate":"2026-11-10"}],"posts":[],"research":[{"title":"ICM2SHELL (CVE-2026-76964 and CVE-2026-89126): A Critical Pre-Authentication Vulnerability in SAP NetWeaver's ICM and Web Dispatcher","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","authors":"Pablo Artuso / Onapsis Research Labs","date":"2026-11-10"},{"title":"SAP Security Patch Day for November 2026","url":"https://onapsis.com/blog/sap-security-patch-day-nov-2026/","authors":"Onapsis Research Labs","date":"2026-11-10"}],"impact":{"kind":"single-product","product":"SAP NetWeaver ICM / SAP Web Dispatcher","versions":[{"version":"SAP Kernel (Unicode and non-Unicode) and Web Dispatcher 7.53; HTTP/HTTPS reach; WebSocket upgrade on by default","status":"affected","versions":"1616 / 1617","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"SAP Kernel (Unicode and non-Unicode) & SAP Web Dispatcher 7.53: fixed patch levels 1616, 1617. Onapsis recommends applying the latest available patch for the release; listed patch levels may no longer be available for download."},"addedDate":"2026-11-10"},{"version":"SAP Kernel (Unicode and non-Unicode) and Web Dispatcher 7.54; HTTP/HTTPS reach; WebSocket upgrade on by default","status":"affected","versions":"710","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"SAP Kernel (Unicode and non-Unicode) & SAP Web Dispatcher 7.54: fixed patch level 710."},"addedDate":"2026-11-10"},{"version":"SAP Kernel (Unicode) and Web Dispatcher 7.77; HTTP/HTTPS reach; WebSocket upgrade on by default","status":"affected","versions":"914","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"SAP Kernel (Unicode) & SAP Web Dispatcher 7.77: fixed patch level 914."},"addedDate":"2026-11-10"},{"version":"SAP Kernel (Unicode) and Web Dispatcher 7.93; HTTP/HTTPS reach; WebSocket upgrade on by default. PL 419 is still affected","status":"affected","versions":"401 / 420+","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"For 7.93 a higher patch level does not always mean a fixed one: PL 419, for example, is still affected. Only the updated PL 401 Stack Kernel, PL 402 (once released) and PL 420 or higher include the fix (see SAP Note 3778788, FAQ #6)."},"addedDate":"2026-11-10"},{"version":"SAP Kernel (Unicode) and Web Dispatcher 9.16; HTTP/HTTPS reach; WebSocket upgrade on by default","status":"affected","versions":"111","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"SAP Kernel (Unicode) & SAP Web Dispatcher 9.16: fixed patch level 111."},"addedDate":"2026-11-10"},{"version":"SAP Kernel (Unicode) 9.18; HTTP/HTTPS reach; WebSocket upgrade on by default. Onapsis table lists kernel, not Web Dispatcher, for 9.18","status":"affected","versions":"37","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"SAP Kernel (Unicode) 9.18: fixed patch level 37."},"addedDate":"2026-11-10"},{"version":"SAP Kernel (Unicode) 9.20; HTTP/HTTPS reach; WebSocket upgrade on by default. Onapsis table lists kernel, not Web Dispatcher, for 9.20","status":"affected","versions":"11 / 13","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"SAP Kernel (Unicode) 9.20: fixed patch levels 11, 13."},"addedDate":"2026-11-10"},{"version":"SAP HANA Database 2.0 Web Dispatcher in XS Classic (revisions 079 and 089); HTTP/HTTPS reach; WebSocket upgrade on by default","status":"affected","versions":"2.00.079.11 / 2.00.089.05","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"SAP HANA Database 2.0 (WD in XS Classic), Revisions 079 & 089: 2.00.079.11, 2.00.089.05."},"addedDate":"2026-11-10"},{"version":"SAP Extended Application Services 1.0 (XS Advanced / XS Runtime 1) SP05; HTTP/HTTPS reach; WebSocket upgrade on by default","status":"affected","versions":"Patch 4","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"SAP Extended Application Services 1.0 (XS Advanced / XS Runtime 1) SP05: Patch 4."},"addedDate":"2026-11-10"},{"version":"Out-of-maintenance kernels 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85, 7.89; HTTP/HTTPS reach; WebSocket upgrade on by default","status":"eol-migrate","versions":"No fix on these lines; upgrade to a supported downward-compatible kernel","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"Kernel releases that are no longer under maintenance (7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89) are also affected and may not receive a fix. They must be upgraded to a supported downward-compatible kernel (see SAP Note 3778788, FAQ #4)."},"addedDate":"2026-11-10"},{"version":"Dual-stack (AS ABAP + AS Java); HTTP/HTTPS reach on the ABAP ICM / Web Dispatcher","status":"affected","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"SAP NetWeaver AS Java is not affected, but dual-stack installations are, because of their ABAP stack."},"addedDate":"2026-11-10"},{"version":"SAP NetWeaver AS Java alone","status":"vendor-stated-not-affected","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"SAP NetWeaver AS Java is not affected, but dual-stack installations are, because of their ABAP stack."},"addedDate":"2026-11-10"},{"version":"SAP Kernel 7.22","status":"vendor-stated-not-affected","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/","quote":"Kernel 7.22 is not affected."},"addedDate":"2026-11-10"},{"version":"SAP Content Server","status":"vendor-stated-not-affected","vendorStatement":{"date":"2026-11-10","url":"https://onapsis.com/blog/sap-security-patch-day-nov-2026/","quote":"The Web Dispatcher that is part of SAP HANA Extended Application Services Classic Model and Advanced Model is also affected. SAP Content Server is not affected."},"addedDate":"2026-11-10"}]},"pocs":[],"pocEmptyState":"No public PoC indexed. Onapsis (10 Nov 2026) says the labs gave SAP a working unauthenticated exploit and withheld technical exploitation details. GitHub Advisory GHSA-5hvr-9cj9-6mcg is the NVD republish of CVE-2026-76964, not a PoC. No public Nuclei detector or Sigma rule was found on 10 Nov 2026. Independent public exploit: not verified.","_feed":{"page":"https://vuln2shell.com/vulns/icm2shell-sap-netweaver-web-dispatcher","json":"https://vuln2shell.com/vulns/icm2shell-sap-netweaver-web-dispatcher.json","iocsCsv":"https://vuln2shell.com/vulns/icm2shell-sap-netweaver-web-dispatcher/iocs.csv","stix":"https://vuln2shell.com/vulns/icm2shell-sap-netweaver-web-dispatcher/stix.json","badges":{"patch":"Patched","itw":"No known ITW","poc":"No public PoC indexed"}}}