SAP patches ICM2SHELL and PROXYGATE maximum severity flaws (CVE-2026-76964, CVE-2026-120017, CVE-2026-89103, CVE-2026-89126)

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5643 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SAP ICM/Web Dispatcher/Gateway Spawning Shell or Download Tool (ICM2SHELL / PROXYGATE RCE as <sid>adm)

Detects OS command execution as <sid>adm spawned directly by the SAP kernel network services icman (ICM), sapwebdisp (Web Dispatcher) or gwrd (Gateway). Both ICM2SHELL (CVE-2026-76964 / CVE-2026-89126, WebSocket fragment reassembly memory corruption) and PROXYGATE (CVE-2026-89103, CPI-C ACL bypass starting an attacker-chosen program) end in a child process of these services, which does not occur in normal operation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T1059.004
• Data sources: sysmon_linux, linux_auditd, mde_linux
• Severity: critical
• Confidence: high

Splunk SPL

```comment
TL-2026-5643 ICM2SHELL/PROXYGATE: interpreter or download tool spawned by icman, sapwebdisp or gwrd. Requires Sysmon for Linux (or equivalent EDR) process-creation telemetry.
```
index=linux sourcetype="sysmon:linux" EventCode=1
    (ParentImage="*/icman" OR ParentImage="*/sapwebdisp" OR ParentImage="*/gwrd")
    (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/zsh" OR Image="*/python*" OR Image="*/perl" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat" OR Image="*/socat")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentCommandLine) as parent_commands by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User ParentImage Image commands parent_commands count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("icman", "sapwebdisp", "gwrd")
| where FileName in~ ("sh", "bash", "dash", "zsh", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: SAP Kernel Network Service Spawning Shell or Download Utility
id: 5a1c0e52-3b7d-4f6a-9d21-7c4e8a0b1f01
status: experimental
description: Detects a shell, scripting interpreter or download utility spawned by the SAP ICM (icman), Web Dispatcher (sapwebdisp) or Gateway (gwrd) process, the expected outcome of ICM2SHELL and PROXYGATE exploitation.
references:
    - https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/
    - https://onapsis.com/blog/proxygate-cve-2026-89103-sap-netweaver-gateway-threat-advisory/
    - https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - cve.2026.76964
    - cve.2026.89126
    - cve.2026.89103
    - cve.2026.120017
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/icman'
            - '/sapwebdisp'
            - '/gwrd'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/zsh'
            - '/perl'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/socat'
    selection_python:
        Image|contains: '/python'
    condition: selection_parent and (selection_child or selection_python)
falsepositives:
    - Custom SAP integrations that deliberately launch scripts from the gateway
    - Vendor monitoring agents wrapped around SAP kernel binaries
level: critical

Known false positives:

• Custom SAP integrations or external-command wrappers started from the gateway that legitimately spawn scripts
• Troubleshooting sessions where an admin attaches a shell wrapper to icman or sapwebdisp

Tuning notes: Baseline parent/child pairs for 7 days per SID and allowlist exact CommandLine values for approved wrappers. Extend ParentImage with disp+work only if your landscape never uses SM69/sapxpg external commands. Confirm Sysmon for Linux or EDR collects ProcessCreate on all SAP hosts.

• 🔒 Repeated icman/sapwebdisp/gwrd Crash Signals (ICM2SHELL Exploitation Attempt Indicator) · unlock with TL Creds
• 🔒 SAP Secure Store and Profile Credential Harvesting Commands (Post-Exploitation Credential Theft) · unlock with TL Creds
• 🔒 External Connections to [indicator] (PROXYGATE CPI-C Probing) · unlock with TL Creds
• 🔒 WebSocket Upgrade (HTTP 101) Against SAP ICM/Web Dispatcher from External Sources (ICM2SHELL Surface) · unlock with TL Creds
• 🔒 SAP Gateway ACL File or gw/acl_mode_proxy Modified via Command Line ([indicator]/[indicator]/[indicator] Tampering) · unlock with TL Creds
• 🔒 SAP <sid>adm Account Using SSH/SCP with Host-Key Bypass or sshpass (Lateral Movement from Compromised SAP Host) · unlock with TL Creds
• 🔒 SAP Service Stop and Data Destruction Commands Run as <sid>adm (Post-PROXYGATE/ICM2SHELL Impact) · unlock with TL Creds
• 🔒 SAP Kernel Network Service Initiating Outbound Connection to Non-RFC1918 Address (Reverse Shell/C2 after ICM2SHELL/PROXYGATE) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5643.

Technical analysis

On 2026-11-10 SAP released fixes for 35 vulnerabilities, four of them rated CVSS 10.0. Per SAP's advisory page the four are: CVE-2026-76964 (Memory Corruption in SAP NetWeaver AS ABAP Internet Communication Manager, Note 3778530), CVE-2026-89126 (Memory Corruption in SAP Web Dispatcher, Note 3778556), CVE-2026-89103 (Broken Access Control in SAP Gateway, Note 3798345) and CVE-2026-120017 (Missing Authentication in the SAML2 Service Provider of SAP NetWeaver AS ABAP and ABAP Platform, Note 3849308). Onapsis Research Labs found and reported three of the four through coordinated disclosure; CVE-2026-120017 was not named by Onapsis. SAP states unauthenticated remote attackers could fully compromise targeted systems.

ICM2SHELL (CVE-2026-76964 + CVE-2026-89126): a memory corruption flaw in the SAP Kernel's handling of WebSocket traffic, specifically reassembly of fragmented messages, in code shared by the ICM and the Web Dispatcher. A crafted sequence of WebSocket messages makes the component write attacker-controlled data past the end of the memory reserved for the connection, producing either a process crash (denial of service) or controlled memory corruption leading to OS command execution as <sid>adm. WebSocket upgrade support is enabled by default whether or not applications use it, and some default S/4HANA ICF services accept WebSocket connections without authentication. Exposure covers AS ABAP (and dual-stack) kernel 7.40 or higher, standalone Web Dispatchers and the Web Dispatcher embedded in HANA XS Classic/Advanced; Java-only systems and kernel 7.22 are not affected. NVD scores both CVEs CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0); CVE-2026-76964 is mapped to CWE-1287 and CVE-2026-89126 to a heap-based buffer overflow class (CWE-122). A working exploit was provided to SAP; Onapsis has not observed in-the-wild exploitation and states every exploitation attempt is likely to crash the process at least once.

PROXYGATE (CVE-2026-89103): a pre-authentication flaw in the CPI-C layer of the SAP kernel gateway, affecting ABAP, AS Java, dual-stack and standalone gateways. NVD describes it as a default gateway ACL with excessive privileges that lets an external attacker be classified as an internal application server (CWE-863). A crafted series of CPI-C conversation requests makes the gateway treat the unauthenticated request as internal; it then passes 'allow internal' rules in secinfo/reginfo and the gateway starts an attacker-chosen program, yielding command execution as <sid>adm. The flaw is reachable only where the proxy ACL (prxyinfo) permits it: a permissive prxyinfo (e.g. P SOURCE=* DEST=*) is vulnerable regardless of patch level, and with no prxyinfo the default depends on gw/acl_mode_proxy, which ships as 0 (allow-all). secinfo/reginfo hardening does not mitigate it. Onapsis lists credential theft from the secure store and profiles, lateral movement via RFC destinations, persistence and service disruption or data destruction as post-exploitation impact. A proof of concept was shared with SAP; exploit details are deliberately withheld and no in-the-wild exploitation has been observed.

CVE-2026-120017: per NVD, SAP NetWeaver AS ABAP and ABAP Platform do not sufficiently verify incoming authentication assertions under certain configurations; an unauthenticated attacker could send specially crafted data to bypass authentication and impersonate any user, including privileged accounts (CVSS 3.1 10.0, CWE-347). Affected: SAP_BASIS 702, 731, 740, 750-758, 816, 920, 921, 922. No exploit mechanics were published.

Context: the same Patch Day fixed other critical issues including CVE-2026-76965 (OS command injection in ABAP Application Server, 9.9, Note 3792735), CVE-2026-109803 (code injection in NetWeaver Knowledge Management, 9.9), CVE-2026-109795 (missing authorization in S4CRM, 9.9), CVE-2026-89119 (CSRF in Web Dispatcher/ICM, 9.6) and CVE-2026-109798 (XXE in BusinessObjects, 9.1). BleepingComputer notes that the earlier CVE-2026-58231 (SAP Commerce Cloud, August) was reported exploited days after patching, that CVE-2026-44756 (OVERPASS, September, SAP Kernel memory corruption) and CVE-2026-89111 (October, BTP OAuth2 SSRF) were earlier maximum-severity fixes, and that CISA lists 14 SAP flaws as actively exploited since November 2021, three abused by ransomware groups. Onapsis states its Defend product has monitored for the ICM2SHELL and PROXYGATE exploitation patterns since before the patch.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Impact

T1485 Data Destruction; T1489 Service Stop; T1499.004 Endpoint Denial of Service: Application or System Exploitation

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Remediation

Patches

• ICM2SHELL fixed kernel levels: 7.53 PL 1616/1617, 7.54 PL 710, 7.77 PL 914, 7.93 PL 401/420 (PL 419 still affected), 9.16 PL 111, 9.18 PL 37, 9.20 PL 11/13; HANA DB 2.00.079.11 / 2.00.089.05; XSA 1.0 SP05 Patch 4
• PROXYGATE minimum kernel levels: 7.22 EXT/EX2/EX3 PL 1612, 7.53 PL 1625, 7.54 PL 718, 7.77 PL 915, 8.04 PL 244, 9.20 PL 16, 9.21 PL 4; then set gw/acl_mode_proxy = 1 (7.93 and 9.16 only need the parameter)
• CVE-2026-120017: apply SAP Note 3849308

Immediate actions

• Apply SAP Security Notes 3778530, 3778556, 3798345 and 3849308 (November 2026 Patch Day) on every application server and Web Dispatcher, starting with internet-facing Web Dispatchers/ICMs
• Restrict network access to ICM/Web Dispatcher HTTP/HTTPS ports and SAP Gateway ports (33NN/48NN) to required hosts
• Remove permissive prxyinfo rules (e.g. P SOURCE=* DEST=*), starting with internet-reachable gateways
• Set gw/acl_mode_proxy = 1 after applying kernel patches; close internet exposure of gateways via SAProuter or partner routes

Workarounds

• ICM2SHELL: set icm/HTTP/support_websocket_upgrade=FALSE and restart (impacts WebSocket scenarios; check logs for status 101 first)
• ICM2SHELL: front backends with a patched Web Dispatcher (7.53 PL 1629, 7.54 PL 723, 7.93 PL 430, 9.16 PL 200 or higher); not effective with icm/server_port_<x> PROT=ROUTER or for directly reachable backends
• PROXYGATE: no official workaround before patching; a restrictive prxyinfo file reduces exposure

Longer-term hardening

• Upgrade out-of-maintenance kernels (7.20, 7.21, 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85, 7.89) to a supported downward-compatible kernel
• Monitor dev_icm and dev_webdisp for unexpected restarts and review ICM/WD HTTP logs for status 101 WebSocket upgrades
• SAP Private Cloud (RISE) customers should review SAP Note 3849055; consult FAQ Notes 3778788 (ICM2SHELL) and 3810197 (PROXYGATE)
• Review SAML2 Service Provider configuration and monitor for anomalous SAML assertions until Note 3849308 is applied

Affected and fixed versions

• SAP — SAP NetWeaver AS ABAP (Internet Communication Manager) / SAP Kernel
  Vulnerable versions: KRNL64UC 7.53; KERNEL 7.53; KERNEL 7.54; KERNEL 7.77; KERNEL 7.93; KERNEL 9.16; KERNEL 9.18; KERNEL 9.20; unsupported kernels 7.40-7.89
  Fixed in: 7.53 PL 1616/1617; 7.54 PL 710; 7.77 PL 914; 7.93 PL 401/420; 9.16 PL 111; 9.18 PL 37; 9.20 PL 11/13
• SAP — SAP Web Dispatcher (incl. HANA XS Classic/Advanced)
  Vulnerable versions: WEBDISP 7.53; WEBDISP 7.54; WEBDISP 7.77; WEBDISP 7.93; WEBDISP 9.16; HDB 2.00; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1
  Fixed in: SAP Note 3778556 patch levels; HANA DB 2.00.079.11 / 2.00.089.05; XSA 1.0 SP05 Patch 4
• SAP — SAP Gateway
  Vulnerable versions: KRNL64NUC 7.22/7.22EXT; KRNL64UC 7.22/7.22EXT/7.53/8.04; KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.20, 9.21
  Fixed in: 7.22 EXT PL 1612; 7.53 PL 1625; 7.54 PL 718; 7.77 PL 915; 8.04 PL 244; 9.20 PL 16; 9.21 PL 4; 7.93/9.16 with gw/acl_mode_proxy=1
• SAP — SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
  Vulnerable versions: SAP_BASIS 702; 731; 740; 750-758; 816; 920; 921; 922
  Fixed in: SAP Note 3849308

Timeline

• 2026-11-10 BleepingComputer reports SAP patched four maximum-severity vulnerabilities
• 2026-11-10 Onapsis publishes ICM2SHELL and PROXYGATE threat advisories; reports working exploit/PoC shared with SAP and no in-the-wild exploitation observed; Defend detections for both patterns active since before the patch
• 2026-11-10 NVD publishes CVE-2026-120017 (CVSS 3.1 10.0, CWE-347) for authentication bypass via unverified assertions in SAML2 Service Provider of AS ABAP
• 2026-11-10 NVD publishes CVE-2026-89103 (CVSS 3.1 10.0, CWE-863) for SAP Gateway default ACL that classifies external attackers as internal (PROXYGATE)
• 2026-11-10 NVD publishes CVE-2026-89126 (CVSS 3.1 10.0) for memory corruption in SAP Web Dispatcher (ICM2SHELL second CVE)
• 2026-11-10 NVD publishes CVE-2026-76964 (CVSS 3.1 10.0, CWE-1287) for memory corruption in SAP NetWeaver AS ABAP ICM
• 2026-11-10 SAP November Security Patch Day fixes 35 vulnerabilities, including four CVSS 10.0 flaws (Notes 3778530, 3778556, 3798345, 3849308)
• 2026-11-12 Onapsis webinar on November's SAP Patch Day vulnerabilities scheduled (10am ET)

Sources cited

• SAP November 2026 Security Notes support.sap.com · Advisory · 2026-11-10
• NVD: CVE-2026-76964 NVD (NIST) · Advisory · 2026-11-10
• NVD: CVE-2026-120017 NVD (NIST) · Advisory · 2026-11-10
• NVD: CVE-2026-89103 NVD (NIST) · Advisory · 2026-11-10
• NVD: CVE-2026-89126 NVD (NIST) · Advisory · 2026-11-10
• Onapsis ICM2SHELL threat advisory (CVE-2026-76964, CVE-2026-89126) onapsis.com · Research · 2026-11-10
• Onapsis PROXYGATE threat advisory (CVE-2026-89103) onapsis.com · Research · 2026-11-10
• SAP Security Note 3778530 (CVE-2026-76964) me.sap.com · Vendor report · 2026-11-10
• SAP Security Note 3778556 (CVE-2026-89126) me.sap.com · Vendor report · 2026-11-10
• SAP Security Note 3798345 (CVE-2026-89103) me.sap.com · Vendor report · 2026-11-10
• SAP Security Note 3849308 (CVE-2026-120017) me.sap.com · Vendor report · 2026-11-10
• SAP Security Patch Day landing page url.sap · Vendor report · 2026-11-10
• BleepingComputer: SAP patches ICM2SHELL and PROXYGATE maximum severity flaws BleepingComputer · News · 2026-11-10

More in vulnerability

• CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()
• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation

Previous and next in vulnerability

• Apache Airflow CeleryExecutor Unauthenticated RCE via Forged Broker Callback (CVE-2026-68982) Previous report
• Xen Orchestra Authentication Bypass (VSA-2026-062) Actively Exploited to Hijack VM Servers Next report