SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities
Enterprise software maker SAP on Tuesday announced the release of 42 new and updated security notes, including nine that resolve critical-severity vulnerabilities.
Four of SAP’s new security notes address maximum-severity flaws in NetWeaver (Internet Communication Manager (ICM) and SAML2 Service Provider), Web Dispatcher, and Gateway.
The ICM and Web Dispatcher flaws, tracked as CVE-2026-76964 and CVE-2026-89126, are a single weakness in the SAP kernel component that receives HTTP, HTTPS, and WebSocket traffic.
According to Onapsis, which calls the security defect ICM2SHELL, the issue is related to reassembling large WebSocket messages, which may be split into fragments during a server-browser exchange and then put together by the receiver.
“A specially crafted sequence of WebSocket messages makes the ICM or the WD write attacker-controlled data past the end of the memory it reserved for the connection. Depending on how that data is shaped, the result is either an immediate crash of...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
