Back

SAP Releases Fixes for Critical ICM2SHELL Flaws

lite News Desk 2 min read

SAP released fixes on November 10, 2026, for ICM2SHELL vulnerabilities affecting its NetWeaver Internet Communication Manager and Web Dispatcher. The company's security bulletin assigns a CVSS score of 10.0 and a Critical classification to both memory-corruption issues.

According to Onapsis, the flaws involve the SAP kernel's processing of WebSocket traffic, which the two components share. Its assessment states that an attacker with access to the relevant HTTP or HTTPS port could execute operating-system commands under the <sid>adm account or cause the affected process to crash. Neither credentials nor interaction by a user would be required, according to that assessment.

Onapsis describes the Internet Communication Manager as the component responsible for SAP systems' HTTP, HTTPS and WebSocket traffic. Web Dispatcher serves as a reverse proxy and can be positioned at an organisation's network edge. These are general product characteristics, rather than findings about the configuration of any particular system.

WebSocket functionality is on by default, according to Onapsis. The company also states that S/4HANA includes ICF services through which WebSocket connections can be accepted without authentication. As of its publication on November 10, 2026, the Onapsis research team had observed no active exploitation of ICM2SHELL in the wild.

SAP identifies the NetWeaver AS ABAP Internet Communication Manager vulnerability as CVE-2026-76964, with its fix published in Security Note 3778530. For Web Dispatcher, the bulletin pairs CVE-2026-89126 with Security Note 3778556.

The affected-component entries for Note 3778530 cover KRNL64UC version 7.53 and seven KERNEL versions: 7.53, 7.54, 7.77, 7.93, 9.16, 9.18 and 9.20, according to SAP's bulletin.

For Note 3778556, SAP lists WEBDISP versions 7.53, 7.54, 7.77, 7.93 and 9.16, alongside HDB version 2.00 and KRNL64UC version 7.53. That note's affected-component list also includes XS_ADVANCED_RUNTIME version 1.00 and SAP_EXTENDED_APP_SERVICES version 1. The KERNEL entries under this note are versions 9.20, 9.18, 9.16, 7.93, 7.77, 7.54 and 7.53.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. The flaw affects Linux systems using musl without PAM under specific password-authentication and account conditions.

  2. Exploitation requires a user to open a specially prepared message file; Outlook may then contact an attacker-controlled network destination without its usual warning.

  3. N-able advised customers running N-central on their own premises to disconnect their servers until further instructions.

  4. D-Link’s interim advice is to disable DDP on the switch and applicable interfaces; the company said this stopped tested DDP attack paths.

  5. Docomo’s estimate puts the affected records at up to 300,000; emergency maintenance on both services was still underway on November 6.