Threat video1:00
CVE-2026-76964 SAP NetWeaver ICM RCE: Detection & IOCs
Onapsis reports unauthenticated RCE through SAP NetWeaver ICM with no user interaction: 9 detection rules, 8 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-76964 SAP NetWeaver ICM RCE: Detection & IOCs →
Chapters
- 0:00The hookSAP fixed four maximum-severity flaws.
- 0:04The storyOnapsis reports unauthenticated remote code execution.
- 0:12Attack pathOnapsis reported two memory corruption flaws.
- 0:29AttributionNo threat actor: this was defensive research.
- 0:34Indicators of compromise5 indicators to hunt: 5 file names.
- 0:39MITRE ATT&CK techniques9 ATT&CK techniques, from initial access to impact.
- 0:44Remediation4 steps now: Apply SAP Security Notes.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00SAP fixed four maximum-severity flaws.
0:05Onapsis reports unauthenticated remote code execution.
0:09Found through coordinated disclosure, now patched.
0:13Onapsis reported two memory corruption flaws.
0:16It can crash the Web Dispatcher.
0:18Second flaw classifies outside hosts as internal.
0:21Either yields command execution as sidadm.
0:24SAP patched them; no in-the-wild exploitation.
0:30No threat actor: this was defensive research.
0:345 indicators to hunt: 5 file names.
0:399 ATT&CK techniques, from initial access to impact.
0:444 steps now: Apply SAP Security Notes.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.