SAP ICM2Shell Vulnerability: CVSS 10.0 Kernel Flaws CVE-2026-76964 and CVE-2026-89126 Let Attackers In Without a Login, and the Patch Levels to Install

SAP has fixed two maximum-severity flaws, together called ICM2Shell, that let an attacker with no password take over an SAP system by sending crafted WebSocket messages to its web port. If your company runs finance, payroll, purchasing or warehouse operations on SAP, a successful attacker would run commands as the account that runs SAP itself, so these patches belong in this week's change window, not next quarter's.

The fixes shipped on SAP's November 2026 Security Patch Day, Tuesday, November 10, 2026. Onapsis Research Labs found and reported the flaws and published its own advisory the same day.

What is ICM2Shell?

ICM2Shell is the name Onapsis gave to two CVEs that come from one bug in the SAP Kernel:

SAP also published FAQ Note 3778788 alongside them.

The ICM is the part of an SAP system that handles web traffic. Fiori apps, web services and APIs all come in through it. The Web Dispatcher is SAP's own load balancer and front door, and it is often the piece that faces the internet. Onapsis says both use the same kernel code to put back together WebSocket messages that arrive in pieces. A crafted sequence of those messages can write attacker-controlled data past the memory set aside for the connection.

What is confirmed, and what is not

Confirmed by SAP and Onapsis:

• Both notes carry a CVSS score of 10.0, the highest possible.
• No login is needed. An attacker only needs network access to the system's HTTP or HTTPS port.
• Onapsis gave SAP a working exploit that achieves full remote code execution without a login, running commands as the <sid>adm operating system user.
• WebSocket support is on by default, so a system can be exposed even if nothing you run uses WebSockets.
• Even without code execution, the bug can crash the ICM or Web Dispatcher. Fiori apps, web services and APIs go offline until the process restarts, and a crashed Web Dispatcher cuts off every SAP system behind it.

Not known or not claimed:

• Onapsis says it had not seen attacks in the wild as of publication. That describes one day. It is not a guarantee for next week.
• Neither source gives a count of exposed SAP systems on the internet.
• The full notes sit behind an SAP support login, so most of the public detail comes from Onapsis.

Which SAP systems are affected

Your kernel decides whether you are exposed, not which SAP applications you run. According to Onapsis:

• Affected: any SAP NetWeaver AS ABAP system on kernel 7.40 or later, every SAP Web Dispatcher (including the one built into SAP HANA XS), and dual-stack systems (ABAP plus Java).
• Not affected: SAP NetWeaver AS Java on its own, and kernel 7.22.
• Out of maintenance: kernels 7.40, 7.41, 7.42, 7.45, 7.49, 7.73, 7.81, 7.85 and 7.89 are affected but no longer maintained. The fix there is an upgrade to a supported kernel, not a patch.

SAP ICM2Shell fixed versions

Onapsis lists these kernel and Web Dispatcher patch levels as fixed. Any lower patch level is vulnerable.

Check these against FAQ Note 3778788 before you schedule the work, because SAP can update its notes after release.

How to check your SAP kernel version

• In SAP GUI, open System > Status and read the kernel release and patch level.
• On the server, run disp+work -version as the <sid>adm user. For a standalone Web Dispatcher, run sapwebdisp -version.
• Check every application server and every Web Dispatcher, not just the central instance. Onapsis says the fix has to go on every application server.
• To see whether WebSockets are switched on, display the profile parameter icm/HTTP/support_websocket_upgrade in transaction RZ11.

What to do this week

1. Patch internet-facing systems first. Onapsis recommends starting with Web Dispatchers and ICMs reachable from the internet, then production, then everything else.
2. Plan upgrades for unmaintained kernels. If you run one of the out-of-maintenance releases above, there is no patch to install.
3. If you cannot patch right away, use a stopgap. Setting icm/HTTP/support_websocket_upgrade to FALSE and restarting removes the flaw. SAP warns this has a significant impact on interactive and integration scenarios. Another option: a patched Web Dispatcher in front can shield backends that are only reachable through it (Onapsis cites 7.53 PL 1629 as an example), but not if it is set up as a router (PROT=ROUTER). Neither one replaces the patch.
4. Limit who can reach the web ports. SAP HTTP and HTTPS ports should only be reachable from the networks that actually need them.
5. Look for signs of probing. Onapsis suggests reviewing the dev_icm and dev_webdisp logs for unexpected restarts, along with unplanned changes in the icman or Web Dispatcher process ID.
6. Get a date from whoever runs SAP for you. If a hosting company or SAP partner manages your system, ask in writing when the November notes will be applied.

Plan for a busy maintenance window. SAP's November bulletin lists 35 new security notes, 4 GitHub security advisories and 3 updated notes. The same day, Onapsis also disclosed PROXYGATE (CVE-2026-89103), a separate flaw in the SAP NetWeaver Gateway that is fixed in Note 3798345.

Why this matters for a business

SAP is rarely one application. It holds the ledger, payroll, customer records and supplier pricing, and it connects to banks, carriers and other company systems. An attacker running commands as <sid>adm is not limited to one screen or one user's permissions. They are running as SAP itself on that server.

The crash alone is a real business problem. A Web Dispatcher that keeps falling over means orders, approvals and integrations stop, even if no data is taken.

The harder issue is ownership. Many companies have SAP run by a partner, and patches go in on whatever schedule the contract says. We covered that gap in Who Is Patching the Software That Runs Your Business?. Also remember that a system someone "updated" this year can still be on a kernel below the fixed level. Checking the actual patch level, as we explained in Updated Is Not the Same as Patched, is the only way to know.

SAP ICM2Shell questions people are asking

Is ICM2Shell being exploited?

Not as far as anyone has reported. Onapsis said it had not seen exploitation in the wild as of November 10, 2026. Watch SAP's notes and CISA's Known Exploited Vulnerabilities catalog for changes.

Does an attacker need an SAP login?

No. According to Onapsis, network access to the HTTP or HTTPS port is enough.

Is SAP S/4HANA affected?

S/4HANA runs on the ABAP stack, so it is affected if its kernel is 7.40 or later and below the fixed patch level.

Is SAP AS Java affected?

Not on its own. Dual-stack systems are affected through their ABAP side.

What is the difference between CVE-2026-76964 and CVE-2026-89126?

It is the same bug in shared kernel code. CVE-2026-76964 covers the ICM in AS ABAP and CVE-2026-89126 covers the Web Dispatcher.

Can I just turn off WebSockets?

You can, as a temporary measure. Setting icm/HTTP/support_websocket_upgrade to FALSE removes the flaw, but features that rely on WebSockets will stop working, and you still need to patch.

The bigger lesson

ICM2Shell sits in a feature that is switched on by default, so plenty of companies are exposed through something they never chose to use. Knowing what your servers have listening, and what patch level each one is actually on, matters more than any single advisory.

For help reviewing what your servers expose and keeping them patched, see security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: Onapsis ICM2SHELL threat advisory; SAP Security Patch Day, November 2026.