CISAAnalysisCISA alerts on critical CVSS 10.0 ICM2SHELL memory corruption flaw in SAP NetWeaver
What happened.CISA issued an urgent advisory after SAP patched four maximum-severity CVSS 10.0 flaws, headed by an unauthenticated memory corruption flaw in NetWeaver.
Why it matters.SAP NetWeaver underpins mission-critical enterprise resource planning, supply chain management, and corporate financial databases globally. When memory corruption vulnerabilities permit unauthenticated remote code execution, attackers compromise entire enterprise operational backbones. Enterprise IT teams must apply SAP kernel corrections across all NetWeaver instances immediately. Security teams should restrict Internet Communication Manager ports from public internet routing.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-76964 in security note 3778530, the defect resides in the Internet Communication Manager of NetWeaver AS ABAP.
- Exploit method: Unauthenticated remote attackers send crafted WebSocket control frames with malformed length fields, triggering an out-of-bounds heap write.
- System compromise: Successful exploitation grants remote code execution under the privileges of the system installation user without user interaction.
- Authentication bypass: SAP also resolved CVE-2026-120017 in note 3849308, addressing missing cryptographic verification in SAML2 Service Providers.
- Remediation releases: SAP published security updates across affected NetWeaver kernels, urging teams to patch internet-facing enterprise resource systems immediately.