SAP ICM2SHELL and PROXYGATE: Pre-Authentication RCE via WebSocket Memory Corruption and Internal Host Spoofing in the Gateway

1. Basic Information

• Article Title: SAP patches ICM2SHELL and PROXYGATE maximum severity flaws
• Publisher: BleepingComputer
• Publication Date: 2026-11-10
• Collection Date: 2026-11-11T07:47:50+09:00
• Source: BleepingComputer
• Related Sources: Onapsis: ICM2SHELL, Onapsis: PROXYGATE, SAP November 2026 Security Patch Day
• Related Malware: None specified
• Related Threat Groups: None specified
• Related CVEs: CVE-2026-76964, CVE-2026-89126, CVE-2026-89103
• Related Products and Technologies: SAP NetWeaver AS ABAP, SAP Internet Communication Manager, SAP Web Dispatcher, SAP Gateway, SAP HANA XS
• Severity: Critical
• Basis of Severity: CVSS 10.0 unauthenticated RCE affects internet-facing ICM / Web Dispatcher and broad SAP Gateway components, and Onapsis reproduced sid-adm command execution using end-to-end exploits.

2. Quick Summary

ICM2SHELL corrupts ICM / Web Dispatcher memory during the reassembly of crafted WebSocket fragments, while PROXYGATE uses crafted CPI-C requests to make the Gateway mistake an external client's requests for requests from an internal application server. Both can lead to OS command execution as sid-adm before authentication, though active exploitation has not been confirmed.

3. Attack Flow

ICM2SHELL and PROXYGATE are independent attack paths; steps 1–2 and steps 3–4 are not a sequential chain.

1. In ICM2SHELL, an attacker sends a crafted WebSocket message sequence to the HTTP(S) port, triggering a heap out-of-bounds write via fragment reassembly.
2. The memory corruption is controlled to execute OS commands under the sid-adm privilege on the ICM / Web Dispatcher.
3. In PROXYGATE, an attacker sends a crafted CPI-C conversation to the Gateway, causing the request source to be misidentified as an internal application server.
4. If prxyinfo is permissive, or if it is missing and gw/acl_mode_proxy=0, the request is treated as internal and allowed, resulting in command execution as sid-adm.

4. Attacker Position and Execution Location

• An unauthenticated remote attacker with network reachability to the ICM / Web Dispatcher HTTP(S) port or the SAP Gateway port.

5. Victim and Administrator Perspective

Victim Perspective

• May manifest as ERP outages, transaction anomalies, and business data tampering or leakage.

Administrator Perspective

• Onapsis lists unexpected ICM / Web Dispatcher crashes and restarts (checked via the dev_icm / dev_webdisp traces) and icman PID changes as investigation points. Gateway proxy connections and sid-adm child processes are investigation candidates and may not always leave records.

6. Success and Failure Conditions

Success Conditions

• For ICM2SHELL, WebSocket support must be enabled on the affected kernel, and the attacker must be able to reach the HTTP(S) port.
• For PROXYGATE, the attacker must be able to reach the Gateway, and either prxyinfo must permit the attacker's proxy connections or, if prxyinfo is absent, the Gateway's default proxy policy must allow all proxy connections.

Failure Conditions and Mitigations

• Apply SAP Security Notes 3778530, 3778556, and 3798345, and verify the fixed kernel level for each component.
• PROXYGATE requires restricting the proxy policy in addition to patching. If prxyinfo exists, it must be made restrictive; exposure remains regardless of parameters or patch levels as long as a permissive prxyinfo persists. Set gw/acl_mode_proxy=1 on supported kernels only if prxyinfo does not exist (older unpatched kernels require a patch first).
• As a temporary mitigation for ICM2SHELL, disable WebSocket support or protect the backend with a Web Dispatcher running one of the following patch levels or a later patch level for the corresponding release: 7.53 PL1629, 7.54 PL723, 7.93 PL430, or 9.16 PL200. The latter is effective only if backend access is restricted to that Web Dispatcher and the PROT=ROUTER configuration is not used. Evaluate business impact beforehand in all cases.

7. What Happens upon Success

• Arbitrary OS command execution under the sid-adm privilege and full control of the SAP system.
• Acquisition of secure store and database credentials, reading or tampering with business data, persistence, and system shutdown.

8. Observable Logs

• Email: No specific observation points are publicly available.
• Proxy/SWG/DNS: WebSocket upgrades directed to ICM / WD HTTP(S). Difficult to isolate as malicious on its own, so treat it as an investigation candidate combined with crashes, etc.
• Endpoint/EDR: sid-adm child processes spawned from icman, Web Dispatcher, or Gateway, along with binary or profile modifications.
• Identity/IdP: Standard login logs alone are insufficient to detect this activity because exploitation does not require SAP user authentication.
• SaaS/Cloud: Access to SAP configuration, secure store, and RFC destinations (not a log source itself, but an investigation candidate to verify via SAP-side audit and change logs).
• Network: Unknown sources targeting Gateway ports 33NN / 48NN, WebSocket fragment sequences, and proxy connections.

9. Attack Success Assessment

Initial Execution Confirmed

• Public Information: Onapsis verified end-to-end unauthenticated RCE for ICM2SHELL and PROXYGATE using PoCs provided to SAP. In-the-wild exploitation of PROXYGATE was unobserved as of 2026-11-10.
• Verification Scope: This was reproduced in Onapsis's test environment; it does not establish that a real-world system was compromised.

10. Investigation Playbook

• Trigger: Use ICM / WD crashes, Gateway proxy anomalies, and sid-adm child processes as triggers.
• Initial Verification: Check kernel release/patch, WebSocket settings, prxyinfo, gw/acl_mode_proxy, and network exposure.
• Endpoint: Preserve the dev_icm and dev_webdisp traces, process information, profiles, and any available evidence of access to the secure store.
• Authentication & Cloud: Check for system-level activity without SAP users and the use of RFC / database credentials.
• Subsequent Actions: Investigate database access, RFC lateral movement, binary/profile persistence, and data modification.
• Containment: Apply network restrictions, patches, proxy ACL fixes, credential rotation, and system rebuilds if necessary.
• Classification: Distinguish between exploit attempts, process crashes, sid-adm commands, credential access, and business data impacts.

11. Defense and Detection Ideas

• Single Event: Detect unexpected icman / Web Dispatcher crashes and sid-adm shells.
• Timeline Correlation: Correlate WebSocket / Gateway requests -> process restarts / child processes -> secure store / DB access.
• Hunting: Inventory kernel, WD, Gateway, prxyinfo, and profile parameters across all SAP instances.
• Log Gaps: WebSocket HTTP logs may require explicit configuration on older releases.
• Priority Controls: Prioritize patching internet-facing components, proxy policies for all instances, and network restrictions.

12. Facts / Inference / Hypothesis

Facts

• ICM2SHELL (CVE-2026-76964 / 89126) affects ICM and Web Dispatcher via memory corruption during WebSocket reassembly.
• Onapsis provided SAP with a working exploit achieving command execution as sid-adm prior to authentication.
• PROXYGATE (CVE-2026-89103) causes external requests to be misidentified as originating from an internal server at the CPI-C layer.
• PROXYGATE exploitability depends on prxyinfo and gw/acl_mode_proxy settings, and patching alone is insufficient in certain releases.
• Onapsis observed no active exploitation at the time of publication.

Inference

• SAP Basis and SOC teams must jointly review WebSocket and proxy ACL settings and network exposure, alongside version and kernel patches.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under Unresolved Items and Further Investigation.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Sends unauthenticated requests to ICM / Web Dispatcher / Gateway, leading to RCE.
T1555	Credentials from Password Stores	medium	Credential acquisition from the secure store is described as a post-compromise impact.

14. Unresolved Items and Further Investigation

• Third-party in-the-wild exploitation, public exploit code releases, and compatibility impacts across all landscapes remain unconfirmed.

15. Impact on SOCs and Organizations

Organizations running SAP ERP for core business operations should note that sid-adm compromise directly impacts financial, HR, and supply chain data as well as transaction integrity. Verify settings not only on edge Web Dispatchers but also across all application servers and Gateway configurations.

16. Summary by Target Audience

• For SOCs: Correlate ICM / WD crashes, Gateway proxies, and sid-adm processes.
• For Administrators: Apply relevant SAP Notes and verify prxyinfo and gw/acl_mode_proxy.
• For Users: No regular user action is required. Follow business continuity procedures if SAP outages occur.