SAP ICM2SHELL and PROXYGATE Maximum-Severity Flaws: NetWeaver, Web Dispatcher, and Gateway Patching and Detection Guide

SAP's November 2026 Security Patch Day is one of the more consequential releases we have seen this year. Of the 35 vulnerabilities addressed across the product portfolio, four carry maximum severity ratings, and the two drawing the most attention from both defenders and adversaries are the flaws dubbed ICM2SHELL and PROXYGATE, affecting the Internet Communication Manager (ICM), SAP Web Dispatcher, and the SAP Gateway — the internet-facing front doors of virtually every productive SAP landscape.

If you run SAP NetWeaver AS ABAP/Java, S/4HANA on-premises, or expose any SAP HTTP(S) endpoints through Web Dispatcher, treat this as an emergency patch cycle. These are not obscure backend components. The ICM and Gateway terminate external connections for Fiori, web services, RFC, and message-server traffic. A maximum-severity flaw in that layer means an unauthenticated, network-reachable path into the heart of your ERP — where your financial data, HR records, and supply chain integrations live.

This post breaks down what is affected, how these flaw classes are typically weaponized, and gives you concrete detection logic (Sigma, KQL, VQL) plus a verification script you can run today.

Technical Analysis

Affected Components

Based on the November 2026 Security Patch Day release, the maximum-severity issues affect:

• SAP Internet Communication Manager (ICM) — the HTTP/HTTPS/SMTP handler embedded in every NetWeaver AS instance (process icman).
• SAP Web Dispatcher (sapwebdisp) — the standalone reverse proxy/load balancer typically placed in the DMZ in front of SAP systems.
• SAP Gateway (gwrd) — handles RFC and external program registration; historically one of the most abused SAP attack surfaces.
• SAP NetWeaver Application Server (ABAP and Java stacks) — the underlying platform across which the remaining vulnerabilities in the 35-patch bundle land.

These components share the SAP kernel, so the fix is delivered as a kernel patch update plus Security Notes applied via SNOTE/transaction SPAU/SAINT as applicable. Kernel-level fixes mean a restart of affected instances is mandatory — plan maintenance windows accordingly.

How the Flaws Work — Defender's View

ICM2SHELL targets the ICM's HTTP request processing. This vulnerability class — request handling/desynchronization or memory corruption in the HTTP parser — is exploited by sending crafted HTTP requests to an exposed ICM or Web Dispatcher port. Successful exploitation lets an unauthenticated remote attacker escape the intended request-handling context and achieve command execution under the SAP service account (<sid>adm on Linux, SAPService<SID> on Windows). The telltale post-exploitation artifact: the ICM or Web Dispatcher process spawning shell interpreters or OS commands, which legitimate SAP operation almost never does.

PROXYGATE affects the proxy/routing layer — the Web Dispatcher and Gateway's handling of forwarded connections. Flaws in this class allow attackers to abuse the proxy to reach internal services that were never meant to be internet-facing (SSRF-style pivoting), bypass ACL restrictions defined in the Web Dispatcher profile, or invoke unprotected Gateway functions. In practical terms, PROXYGATE turns your DMZ reverse proxy into a tunnel into your internal SAP message server, admin servlets, and adjacent internal infrastructure.

The combination is what makes this patch cycle dangerous: PROXYGATE-class flaws provide the reach, ICM2SHELL-class flaws provide the execution. SAP environments patched only partially remain exposed to chained exploitation.

Exploitation Status

Maximum-severity SAP flaws have a well-documented pattern: proof-of-concept code and scanning activity typically surface within days of patch release, and internet-facing SAP ports (80xx/443xx, 32xx, 33xx) are continuously probed by botnets and initial access brokers. Historical precedent — including past ICM and Web Dispatcher desynchronization flaws that saw rapid in-the-wild weaponization — means defenders should operate under the assumption that any unpatched, internet-reachable ICM/Web Dispatcher instance is being scanned right now. Check whether the associated Security Notes have been added to CISA's Known Exploited Vulnerabilities catalog and treat KEV listing deadlines as mandatory if applicable to your environment (federal civilian agencies under BOD 22-01; everyone else should adopt the same urgency).

Detection & Response

Patching is the priority, but assume compromise and hunt for post-exploitation behavior. The strongest detection signal for ICM2SHELL-class exploitation is SAP infrastructure processes spawning child shells or interpreters. This behavior is so rare in legitimate SAP operation that false positives are minimal.

Sigma Rules

---
title: SAP ICM or Web Dispatcher Spawning Shell Process
description: Detects the SAP Internet Communication Manager (icman), Web Dispatcher (sapwebdisp), or Gateway (gwrd) spawning a command shell or script interpreter, consistent with ICM2SHELL/PROXYGATE post-exploitation command execution.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\icman.exe'
      - '\sapwebdisp.exe'
      - '\gwrd.exe'
      - '\disp+work.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare SAP administrative jobs invoking OS commands via SM49/SM69; verify against change tickets
level: high
---
title: SAP ICM or Web Dispatcher Spawning Shell on Linux
description: Detects SAP kernel binaries on Linux spawning shells or interpreters, a high-fidelity indicator of remote code execution against ICM, Web Dispatcher, or Gateway.
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/icman'
      - '/sapwebdisp'
      - '/gwrd'
      - '/disp+work'
      - '/msg_server'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate external commands configured in SM49/SM69; baseline and whitelist known job names
level: high
---
title: SAP Process Initiating Unexpected Outbound Network Connection
description: Detects ICM, Web Dispatcher, or Gateway processes establishing outbound connections to non-standard ports, potentially indicating PROXYGATE-style pivoting or C2 callback after exploitation.
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\icman.exe'
      - '\sapwebdisp.exe'
      - '\gwrd.exe'
  selection_ports:
    DestinationPort:
      - 4444
      - 5555
      - 6666
      - 7777
      - 8888
      - 9001
      - 1337
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection_image and selection_ports and not filter_internal
falsepositives:
  - Legitimate SAP-to-SAP communication on uncommon ports in complex landscapes; baseline first
level: medium

Microsoft Sentinel / Defender KQL

The following query hunts for SAP infrastructure processes spawning shells, plus unexpected outbound connections from those processes. It works across Windows endpoints via Defender for Endpoint telemetry and Linux hosts onboarded to MDE; for network-layer visibility, the second query pivots on CommonSecurityLog (firewall/CEF ingestion) for traffic to SAP gateway ports from untrusted sources.

// Hunt: SAP ICM/Web Dispatcher/Gateway spawning shells or tools (ICM2SHELL post-exploitation)
let SapProcesses = dynamic(["icman.exe", "icman", "sapwebdisp.exe", "sapwebdisp", "gwrd.exe", "gwrd", "disp+work.exe", "disp+work", "msg_server"]);
let ShellTools = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "certutil.exe", "sh", "bash", "dash", "python", "python3", "perl", "nc", "ncat", "curl", "wget"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (SapProcesses)
| where FileName in~ (ShellTools)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, AccountDomain, ReportId
| sort by TimeGenerated desc;
// Hunt: External connections hitting SAP Gateway/Web Dispatcher ports from suspicious sources
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationPort in (3200, 3201, 3300, 3301, 3600, 8000, 8001, 8080, 8443, 44300, 44301, 50000, 50001)
| where DeviceAction !in ("Allow", "allow", "Accept")
     or SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172."
| summarize ConnectionCount = count(), DistinctSources = dcount(SourceIP) by DestinationIP, DestinationPort, DeviceAction, bin(TimeGenerated, 1h)
| where ConnectionCount > 50 or DistinctSources > 10
| sort by TimeGenerated desc;

Velociraptor VQL

Use this artifact to sweep your SAP application and Web Dispatcher hosts for anomalous processes running under SAP parentage or from SAP executable paths. Run it across the fleet before and after patching to establish a baseline and catch any pre-patch compromise.

-- Hunt for shells, interpreters, or tools spawned in SAP landscape context
-- and enumerate listening SAP processes for unexpected network exposure
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)(cmd|powershell|pwsh|sh|bash|dash|python|perl|nc|ncat|curl|wget)'
       AND (Exe =~ '(?i)sap' OR CommandLine =~ '(?i)(/usr/sap|sapmnt|sapwebdisp|icman|gwrd)'))
   OR Name =~ '(?i)^(icman|sapwebdisp|gwrd|msg_server|disp\\+work)'
ORDER BY CreateTime DESC

Verification & Hardening Script

Run the following on SAP application servers and Web Dispatcher hosts (Linux) to check kernel patch level, inventory listening SAP services, and flag risky ICM/Gateway profile parameters. Adapt paths for your SIDs.

#!/bin/bash
# SAP ICM2SHELL / PROXYGATE verification & hardening audit - run as root or <sid>adm
# 1. Kernel patch level — compare against the November 2026 Security Patch Day baseline
echo "=== Kernel version check ==="
for inst in /usr/sap/*/D*/exe /usr/sap/*/J*/exe /usr/sap/*/SYS/exe/run /usr/sap/*/W*/exe; do
  if [ -x "$inst/disp+work" ]; then
    echo "--- $inst ---"
    "$inst/disp+work" -version 2>/dev/null | grep -Ei 'kernel|patch|release' | head -5
  fi
done
# 2. Listening SAP services — confirm only expected ports are exposed
echo "=== Listening SAP processes ==="
ss -tlnp | grep -Ei 'icman|sapwebdisp|gwrd|msg_server|disp' || echo "No SAP listeners found under netstat scope"
# 3. Risky ICM profile parameters — HTTP desync/smuggling mitigations must be ON after patching
echo "=== ICM profile parameter audit ==="
grep -rhiE 'icm/HTTP|icm/server_port|is/HTTP' /usr/sap/*/SYS/profile/ 2>/dev/null | sort -u
# 4. Gateway security files — reg_info/sec_info must exist and NOT be permissive
echo "=== Gateway ACL audit ==="
find /usr/sap -name 'reg_info' -o -name 'sec_info' 2>/dev/null | while read f; do
  echo "--- $f ---"; cat "$f"
done
echo "=== Checking for wildcard/permissive gateway ACLs ==="
grep -rhE 'PERMIT.*\*|HOST=\*' /usr/sap/*/D*/data/sec_info /usr/sap/*/D*/data/reg_info 2>/dev/null && echo "WARNING: permissive gateway ACL found" || echo "Gateway ACLs look restrictive"
# 5. Web shell hunt in web-accessible SAP directories
echo "=== Web root anomaly scan ==="
find /usr/sap/*/D*/data/icm /usr/sap/*/J*/j2ee -name '*.jsp' -o -name '*.war' -newermt '2026-10-01' 2>/dev/null | head -20

Remediation

1. Apply the November 2026 Security Patch Day updates immediately. All 35 notes are published on the SAP Support Portal under the November 2026 Security Patch Day release: https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html (search "Security Patch Day November 2026"). The four maximum-severity notes covering ICM2SHELL and PROXYGATE require an updated SAP kernel for ICM/Web Dispatcher and Gateway fixes — schedule instance restarts.
2. Prioritize internet-facing systems first. Web Dispatcher hosts in the DMZ and any ICM ports reachable from untrusted networks are the highest-risk assets. If you cannot patch within 24-72 hours, take the endpoint off the internet or place it behind a compensating WAF with strict request normalization.
3. Harden Gateway ACLs. Ensure sec_info and reg_info files exist and restrict registered programs to an explicit allowlist. A permissive Gateway (gw/reg_no_conn_info, wildcard HOST entries) combined with PROXYGATE-class flaws is a direct path to remote command execution via RFC.
4. Enforce ICM hardening parameters. After patching, verify HTTP request handling settings in the instance profile, disable unused ICM services (icm/server_port_* entries you do not need), and confirm HTTP/SMTP plugins are off where not required.
5. Restrict network exposure. ICM HTTP(s) should never be directly internet-exposed without a hardened reverse proxy; Gateway ports 32xx/33xx should be reachable only from known application hosts. Audit firewall rules this week.
6. Hunt before you patch. Because these flaws are maximum severity in internet-facing components, run the Sigma/KQL/VQL detections above against 30-90 days of historical telemetry. Patching closes the door; it does not evict an attacker who walked in last month. Look for <sid>adm/SAPService<SID> spawning shells, unexpected child processes of icman/sapwebdisp, new OS users on SAP hosts, and files written to web-accessible directories.
7. Monitor CISA KEV. If the associated CVEs are added to the Known Exploited Vulnerabilities catalog, federal agencies get a mandated remediation date under BOD 22-01 — use that same deadline as your internal SLA regardless of sector.
8. Verify patch application. Post-patch, re-run the verification script above, confirm kernel patch levels in transaction SM51 (or disp+work -version), and validate via SAP EarlyWatch Alert or Solution Manager that the Security Notes show as implemented.

The window between SAP Patch Day and active scanning is measured in hours, not weeks. Treat ICM2SHELL and PROXYGATE as emergency changes, hunt for pre-patch intrusion, and lock down the Gateway ACLs you have been meaning to fix since the last audit.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub