SAP ICM2SHELL Vulnerability: Four CVSS 10 Flaws

The SAP ICM2SHELL vulnerability is one of four maximum-severity flaws SAP fixed on its November 10 Patch Day. They sit in the components that face the network: the Internet Communication Manager (ICM), Web Dispatcher, Gateway and the SAML2 login. Three of the four can be reached without a login. As of November 11, none of the sources we checked reports attacks.

What Happened With the SAP ICM2SHELL Vulnerability

ICM2SHELL is one weakness in the SAP kernel code that handles HTTP, HTTPS and WebSocket traffic, tracked as CVE-2026-76964 (ICM, SAP Note 3778530) and CVE-2026-89126 (Web Dispatcher, Note 3778556), both CVSS 10.0. Per Onapsis, which found it, a crafted sequence of WebSocket messages makes the component write attacker-controlled data past its reserved memory. Onapsis says it gave SAP a working exploit for unauthenticated remote code execution as the <sid>adm user, and that one connection crashes the process on every kernel release it tested. WebSocket support is on by default, so a system is exposed even if no application uses it.

PROXYGATE (CVE-2026-89103, SAP Gateway, Note 3798345) makes the Gateway believe an outside attacker is an internal application server, so it runs OS commands as <sid>adm, with no user name, password or certificate. Exposure depends on the Gateway’s proxy access-control list (prxyinfo). A permissive list, such as a wildcard source and destination, leaves the system vulnerable at any patch level. With no prxyinfo file, the parameter gw/acl_mode_proxy decides, and it ships as 0, which allows everything. Onapsis says that on most kernels SAP’s fix is a kernel patch plus gw/acl_mode_proxy = 1, so patching alone does not close it. The fourth flaw, CVE-2026-120017 in the NetWeaver SAML2 Service Provider (Note 3849308), lets an unauthenticated attacker impersonate any user in certain configurations.

SAP released 35 new security notes, nine of them critical. Onapsis said on November 10 that it had not observed exploitation, and no other source we read reports attacks as of November 11.

Why It Matters

SAP runs finance, purchasing, production and HR at many German mid-sized companies, and <sid>adm is the account that owns the installation.

In August, SAP fixed CVE-2026-58231 in Commerce Cloud, a maximum-severity flaw that Defused flagged as exploited days after the patch; we covered it on August 14. SAP has since fixed another maximum-severity flaw every month, according to BleepingComputer, and CISA lists 14 SAP flaws as exploited since 2021, three of them used by ransomware groups.

What You Should Do Now

1. Get the November notes (3778530, 3778556, 3798345, 3849308) and check every kernel against them: each application server, every Web Dispatcher and the one embedded in HANA XS. Kernels out of maintenance may not get a fix and need an upgrade. On 7.93, patch level 419 is still affected; 420 or higher is fixed, per Onapsis.
2. Patch by exposure: internet-facing Web Dispatchers and ICM first, then Gateways, then internal systems, production first.
3. If a system cannot be patched yet, SAP Note 3778788 describes two temporary workarounds: set icm/HTTP/support_websocket_upgrade=FALSE and restart, or put a Web Dispatcher on a higher patch level in front of backends reachable only through it. Both can break running scenarios, and neither replaces the patch.
4. For the Gateway, first restrict any permissive prxyinfo file. Then apply the patch from Note 3798345 and set gw/acl_mode_proxy = 1 on every application server (kernels 7.93 and 9.16 need only the parameter). Limit the Gateway ports (33NN, 48NN) to the hosts that need RFC; a Gateway has no reason to face the internet. If you use SAML single sign-on for ABAP, check your configuration against the note for CVE-2026-120017.
5. Onapsis expects every exploitation attempt to crash the ICM or Web Dispatcher at least once. Check dev_icm and dev_webdisp for unexpected restarts.

DIESEC Perspective

Assumption: in many SAP landscapes nobody can say quickly which Web Dispatcher, Gateway or ICM is reachable from where. The kernel patch is the fix, but your exposure decides the order in which you apply it.

Not sure which of your SAP components are reachable from the internet? Contact DIESEC for an exposure assessment and patch verification of your SAP landscape.

Sources: Onapsis | SAP | SecurityWeek | heise | BleepingComputer
Published: 2026-11-13 | Category: Vulnerabilities & Patches | ~4 min read