# SAP patches ICM2SHELL and PROXYGATE maximum severity flaws (CVE-2026-76964, CVE-2026-120017, CVE-2026-89103, CVE-2026-89126)

> SAP's November 2026 Security Patch Day fixed four CVSS 10.0 vulnerabilities in NetWeaver AS ABAP (ICM and SAML2 Service Provider), SAP Gateway and SAP Web Dispatcher. Onapsis, which named the ICM2SHELL and PROXYGATE chains, reports unauthenticated remote code execution as <sid>adm with no user interaction; no in-the-wild exploitation had been observed at publication.

- **Published:** 2026-11-10T12:23:30Z
- **Last reviewed:** 2026-11-10T12:23:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5643
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5643.png
- **ID:** TL-2026-5643
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-76964, CVE-2026-120017, CVE-2026-89103, CVE-2026-89126

## Description

On 2026-11-10 SAP released fixes for 35 vulnerabilities, four of them rated CVSS 10.0. Per SAP's advisory page the four are: CVE-2026-76964 (Memory Corruption in SAP NetWeaver AS ABAP Internet Communication Manager, Note 3778530), CVE-2026-89126 (Memory Corruption in SAP Web Dispatcher, Note 3778556), CVE-2026-89103 (Broken Access Control in SAP Gateway, Note 3798345) and CVE-2026-120017 (Missing Authentication in the SAML2 Service Provider of SAP NetWeaver AS ABAP and ABAP Platform, Note 3849308). Onapsis Research Labs found and reported three of the four through coordinated disclosure; CVE-2026-120017 was not named by Onapsis. SAP states unauthenticated remote attackers could fully compromise targeted systems.

ICM2SHELL (CVE-2026-76964 + CVE-2026-89126): a memory corruption flaw in the SAP Kernel's handling of WebSocket traffic, specifically reassembly of fragmented messages, in code shared by the ICM and the Web Dispatcher. A crafted sequence of WebSocket messages makes the component write attacker-controlled data past the end of the memory reserved for the connection, producing either a process crash (denial of service) or controlled memory corruption leading to OS command execution as <sid>adm. WebSocket upgrade support is enabled by default whether or not applications use it, and some default S/4HANA ICF services accept WebSocket connections without authentication. Exposure covers AS ABAP (and dual-stack) kernel 7.40 or higher, standalone Web Dispatchers and the Web Dispatcher embedded in HANA XS Classic/Advanced; Java-only systems and kernel 7.22 are not affected. NVD scores both CVEs CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0); CVE-2026-76964 is mapped to CWE-1287 and CVE-2026-89126 to a heap-based buffer overflow class (CWE-122). A working exploit was provided to SAP; Onapsis has not observed in-the-wild exploitation and states every exploitation attempt is likely to crash the process at least once.

PROXYGATE (CVE-2026-89103): a pre-authentication flaw in the CPI-C layer of the SAP kernel gateway, affecting ABAP, AS Java, dual-stack and standalone gateways. NVD describes it as a default gateway ACL with excessive privileges that lets an external attacker be classified as an internal application server (CWE-863). A crafted series of CPI-C conversation requests makes the gateway treat the unauthenticated request as internal; it then passes 'allow internal' rules in secinfo/reginfo and the gateway starts an attacker-chosen program, yielding command execution as <sid>adm. The flaw is reachable only where the proxy ACL (prxyinfo) permits it: a permissive prxyinfo (e.g. P SOURCE=* DEST=*) is vulnerable regardless of patch level, and with no prxyinfo the default depends on gw/acl_mode_proxy, which ships as 0 (allow-all). secinfo/reginfo hardening does not mitigate it. Onapsis lists credential theft from the secure store and profiles, lateral movement via RFC destinations, persistence and service disruption or data destruction as post-exploitation impact. A proof of concept was shared with SAP; exploit details are deliberately withheld and no in-the-wild exploitation has been observed.

CVE-2026-120017: per NVD, SAP NetWeaver AS ABAP and ABAP Platform do not sufficiently verify incoming authentication assertions under certain configurations; an unauthenticated attacker could send specially crafted data to bypass authentication and impersonate any user, including privileged accounts (CVSS 3.1 10.0, CWE-347). Affected: SAP_BASIS 702, 731, 740, 750-758, 816, 920, 921, 922. No exploit mechanics were published.

Context: the same Patch Day fixed other critical issues including CVE-2026-76965 (OS command injection in ABAP Application Server, 9.9, Note 3792735), CVE-2026-109803 (code injection in NetWeaver Knowledge Management, 9.9), CVE-2026-109795 (missing authorization in S4CRM, 9.9), CVE-2026-89119 (CSRF in Web Dispatcher/ICM, 9.6) and CVE-2026-109798 (XXE in BusinessObjects, 9.1). BleepingComputer notes that the earlier CVE-2026-58231 (SAP Commerce Cloud, August) was reported exploited days after patching, that CVE-2026-44756 (OVERPASS, September, SAP Kernel memory corruption) and CVE-2026-89111 (October, BTP OAuth2 SSRF) were earlier maximum-severity fixes, and that CISA lists 14 SAP flaws as actively exploited since November 2021, three abused by ransomware groups. Onapsis states its Defend product has monitored for the ICM2SHELL and PROXYGATE exploitation patterns since before the patch.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1021 Remote Services
- T1552.001 Unsecured Credentials: Credentials In Files
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1489 Service Stop
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SAP ICM/Web Dispatcher/Gateway Spawning Shell or Download Tool (ICM2SHELL / PROXYGATE RCE as <sid>adm)** (`TL-2026-5643-SPL-001`)

Detects OS command execution as <sid>adm spawned directly by the SAP kernel network services icman (ICM), sapwebdisp (Web Dispatcher) or gwrd (Gateway). Both ICM2SHELL (CVE-2026-76964 / CVE-2026-89126, WebSocket fragment reassembly memory corruption) and PROXYGATE (CVE-2026-89103, CPI-C ACL bypass starting an attacker-chosen program) end in a child process of these services, which does not occur in normal operation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1059.004
- **Data sources:** sysmon_linux, linux_auditd, mde_linux
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
```comment
TL-2026-5643 ICM2SHELL/PROXYGATE: interpreter or download tool spawned by icman, sapwebdisp or gwrd. Requires Sysmon for Linux (or equivalent EDR) process-creation telemetry.
```
index=linux sourcetype="sysmon:linux" EventCode=1
    (ParentImage="*/icman" OR ParentImage="*/sapwebdisp" OR ParentImage="*/gwrd")
    (Image="*/sh" OR Image="*/bash" OR Image="*/dash" OR Image="*/zsh" OR Image="*/python*" OR Image="*/perl" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat" OR Image="*/socat")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentCommandLine) as parent_commands by host User ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User ParentImage Image commands parent_commands count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("icman", "sapwebdisp", "gwrd")
| where FileName in~ ("sh", "bash", "dash", "zsh", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: SAP Kernel Network Service Spawning Shell or Download Utility
id: 5a1c0e52-3b7d-4f6a-9d21-7c4e8a0b1f01
status: experimental
description: Detects a shell, scripting interpreter or download utility spawned by the SAP ICM (icman), Web Dispatcher (sapwebdisp) or Gateway (gwrd) process, the expected outcome of ICM2SHELL and PROXYGATE exploitation.
references:
    - https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/
    - https://onapsis.com/blog/proxygate-cve-2026-89103-sap-netweaver-gateway-threat-advisory/
    - https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - cve.2026.76964
    - cve.2026.89126
    - cve.2026.89103
    - cve.2026.120017
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/icman'
            - '/sapwebdisp'
            - '/gwrd'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/zsh'
            - '/perl'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/socat'
    selection_python:
        Image|contains: '/python'
    condition: selection_parent and (selection_child or selection_python)
falsepositives:
    - Custom SAP integrations that deliberately launch scripts from the gateway
    - Vendor monitoring agents wrapped around SAP kernel binaries
level: critical

```

**Known false positives:**

- Custom SAP integrations or external-command wrappers started from the gateway that legitimately spawn scripts
- Troubleshooting sessions where an admin attaches a shell wrapper to icman or sapwebdisp

**Tuning notes:** Baseline parent/child pairs for 7 days per SID and allowlist exact CommandLine values for approved wrappers. Extend ParentImage with disp+work only if your landscape never uses SM69/sapxpg external commands. Confirm Sysmon for Linux or EDR collects ProcessCreate on all SAP hosts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Repeated icman/sapwebdisp/gwrd Crash Signals (ICM2SHELL Exploitation Attempt Indicator) (locked: unlock with TL Creds)
- SAP Secure Store and Profile Credential Harvesting Commands (Post-Exploitation Credential Theft) (locked: unlock with TL Creds)
- External Connections to [indicator] (PROXYGATE CPI-C Probing) (locked: unlock with TL Creds)
- WebSocket Upgrade (HTTP 101) Against SAP ICM/Web Dispatcher from External Sources (ICM2SHELL Surface) (locked: unlock with TL Creds)
- SAP Gateway ACL File or gw/acl_mode_proxy Modified via Command Line ([indicator]/[indicator]/[indicator] Tampering) (locked: unlock with TL Creds)
- SAP <sid>adm Account Using SSH/SCP with Host-Key Bypass or sshpass (Lateral Movement from Compromised SAP Host) (locked: unlock with TL Creds)
- SAP Service Stop and Data Destruction Commands Run as <sid>adm (Post-PROXYGATE/ICM2SHELL Impact) (locked: unlock with TL Creds)
- SAP Kernel Network Service Initiating Outbound Connection to Non-RFC1918 Address (Reverse Shell/C2 after ICM2SHELL/PROXYGATE) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [BleepingComputer: SAP patches ICM2SHELL and PROXYGATE maximum severity flaws](https://www.bleepingcomputer.com/news/security/sap-patches-four-maximum-severity-security-vulnerabilities/)
- [SAP November 2026 Security Notes](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/november-2026.html?isu_page=1)
- [Onapsis ICM2SHELL threat advisory (CVE-2026-76964, CVE-2026-89126)](https://onapsis.com/blog/icm2shell-cve-2026-76964-cve-2026-89126-sap-netweaver-web-dispatcher-threat-advisory/)
- [Onapsis PROXYGATE threat advisory (CVE-2026-89103)](https://onapsis.com/blog/proxygate-cve-2026-89103-sap-netweaver-gateway-threat-advisory/)
- [NVD: CVE-2026-76964](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76964)
- [NVD: CVE-2026-120017](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120017)
- [NVD: CVE-2026-89103](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-89103)
- [NVD: CVE-2026-89126](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-89126)
- [SAP Security Note 3778530 (CVE-2026-76964)](https://me.sap.com/notes/3778530)
- [SAP Security Note 3778556 (CVE-2026-89126)](https://me.sap.com/notes/3778556)
- [SAP Security Note 3798345 (CVE-2026-89103)](https://me.sap.com/notes/3798345)
- [SAP Security Note 3849308 (CVE-2026-120017)](https://me.sap.com/notes/3849308)
- [SAP Security Patch Day landing page](https://url.sap/sapsecuritypatchday)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5643