SAP Security Patch Day: Four Unauthenticated CVSS 10.0 Flaws in NetWeaver and Web Dispatcher — Detection and Remediation Guide

SAP's monthly Security Patch Day has delivered one of the most severe advisories we've seen from the vendor: four vulnerabilities rated CVSS 10.0 — the maximum possible score — all exploitable by an attacker without credentials. Three of the flaws live in the SAP NetWeaver application server, the runtime platform on which virtually every SAP business system operates. The fourth is in the SAP Web Dispatcher, the reverse-proxy component that sits directly on the internet edge and brokers inbound web requests to NetWeaver.

Two of these flaws reportedly enable unauthenticated code execution. For defenders, that combination — perimeter component, pre-authentication, remote code execution, maximum CVSS — is the worst-case scenario for an enterprise application platform. If you operate SAP, this is a patch-and-hunt-now event.

Why This Demands Immediate Attention

SAP NetWeaver and Web Dispatcher are not niche components. They underpin ERP, S/4HANA, Solution Manager, and thousands of custom business applications. In most architectures, the Web Dispatcher is deliberately exposed to the internet to serve portals, Fiori apps, and integrations — meaning the attack surface for the most dangerous of these flaws is, by design, reachable from anywhere.

The pattern here should sound familiar. Over the past several years, pre-authentication flaws in SAP's internet-facing tier (ICMAD-class memory corruption in the Internet Communication Manager, request smuggling/desynchronization in the Web Dispatcher) have been weaponized within days of disclosure. Threat actors — including ransomware affiliates and state-sponsored groups — actively scan for SAP systems because a single compromised NetWeaver host is a skeleton key into finance, HR, and supply-chain data, and frequently into the broader Windows/Active Directory estate via SAP service accounts.

Four simultaneous 10.0 ratings strongly suggests exploit chains that are trivially reliable with no user interaction, no credentials, and no special conditions. Treat exploitation as imminent.

Technical Analysis

Affected Components

Exposure model:

• Web Dispatcher terminates HTTP/HTTPS from untrusted networks and forwards requests to the backend ICM (Internet Communication Manager) or Java HTTP provider. It parses attacker-controlled request data before any authentication occurs — which is exactly why pre-auth flaws here are rated 10.0. Note that the Web Dispatcher shares its codebase with the standalone ICM and the embedded dispatcher; organizations running the Internet Communication Framework directly (without Web Dispatcher) must verify whether the same kernel patch applies.
• NetWeaver AS handles the application logic. Pre-auth flaws here are typically reachable through the ICM (ABAP) on ports 80NN/443NN or through Java HTTP provider services, depending on which subcomponent is affected.

Exploitation Requirements

Based on the advisory structure:

• Authentication: None required for all four flaws.
• User interaction: None.
• Access vector: Network — for the Web Dispatcher flaw, directly from the internet on internet-exposed deployments; for the NetWeaver flaws, from any host that can reach the application server's HTTP/HTTPS or RFC/dispatcher services.
• Impact: At minimum two of the four permit arbitrary code execution in the context of the SAP service account (<sid>adm on Linux, SAPService<SID> on Windows) — an account that routinely holds database credentials, kernel-level file access, and trusted RFC relationships to every other system in the landscape.

Exploitation Status

At time of writing, the flaws are newly disclosed with patches available via SAP Security Patch Day. No public proof-of-concept has been confirmed in the source reporting, and we have no confirmation of active exploitation or CISA KEV listing yet. However, SAP historically attracts rapid reverse engineering of patches — monitor the CISA KEV catalog and SAP's advisory page daily for the next two weeks. Do not wait for confirmation of in-the-wild exploitation; with CVSS 10.0 pre-auth RCE on a perimeter component, the remediation window is measured in hours-to-days, not change-cycle weeks.

Detection & Response

Patching is the fix, but given the severity you must assume the possibility of pre-patch exploitation and hunt for post-exploitation artifacts. Successful exploitation of these flaws will typically manifest as the Web Dispatcher or NetWeaver work processes spawning child processes or making unexpected outbound connections — because post-exploitation on SAP hosts almost always escalates to OS-level command execution for persistence, credential theft, or staging.

The following detections target those high-fidelity post-exploitation behaviors rather than the (unknown until PoC) exploit payloads themselves.

---
title: SAP Web Dispatcher or NetWeaver Process Spawning Shell
description: Detects SAP Web Dispatcher (sapwebdisp) or NetWeaver work processes (disp+work, dw, icman, jstart) spawning command shells or script interpreters — a strong indicator of post-exploitation following unauthenticated RCE against SAP HTTP-facing components.
references:
  - https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/11
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/sapwebdisp'
      - '/disp+work'
      - '/dw'
      - '/icman'
      - '/jstart'
      - '/igswd_mt'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Custom SAP start/stop scripts wrapping kernel binaries — validate against change records
  - Monitoring agents executing health checks via the SAP host agent
level: critical
---
title: SAP Service Account Process Spawning Shell on Windows
description: Detects SAP NetWeaver Windows processes (disp+work.exe, sapwebdisp.exe, jstart.exe, igswd_mt.exe) spawning cmd.exe, PowerShell, or LOLBins — post-exploitation behavior consistent with RCE via the SAP web tier.
references:
  - https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/11/11
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\disp+work.exe'
      - '\sapwebdisp.exe'
      - '\jstart.exe'
      - '\igswd_mt.exe'
      - '\icman.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - SAP host agent (saphostexec) management tasks — these run under a different parent and should not match
  - Rare SAP-generated OS collector jobs (saposcol is a sibling process, not a shell child)
level: critical
---
title: Outbound Network Connection From SAP Web Dispatcher Process
description: Detects sapwebdisp or icman initiating outbound connections to non-SAP destinations. The Web Dispatcher is a reverse proxy — it accepts inbound connections and forwards to configured backend app servers. Outbound connections to arbitrary external IPs suggest reverse-shell or C2 activity following exploitation.
references:
  - https://thehackernews.com/2026/11/sap-patches-four-cvss-100-flaws.html
  - https://attack.mitre.org/techniques/T1071.001/
author: Security Arsenal
date: 2026/11/11
status: experimental
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/sapwebdisp'
      - '/icman'
    Initiated: 'true'
  filter_backend:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_backend
falsepositives:
  - Web Dispatchers configured to forward to cloud-hosted SAP backends or DNS resolution — tune DestinationIp exclusions to your documented backend topology before deploying
level: high

KQL (Microsoft Sentinel): This query assumes SAP host syslogs (and EDR telemetry, where deployed) are forwarded to Sentinel. It hunts for the same post-exploitation pattern — SAP web-tier processes spawning shells or reaching unexpected destinations — plus a complementary view of inbound request anomalies on the Web Dispatcher's admin port (800NN/443NN) and the ICM admin interface, which should never be reachable from the internet.

// Part 1: SAP web-tier processes spawning shells/script interpreters (Linux syslog + Defender EDR)
let SapParents = dynamic(["sapwebdisp", "disp+work", "icman", "jstart", "igswd_mt"]);
let ShellChildren = dynamic(["sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "base64", "cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "certutil.exe"]);
let EDR = DeviceProcessEvents
| where InitiatingProcessFileName in~ (SapParents)
| where FileName in~ (ShellChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, Source="DefenderEDR";
let Sys = Syslog
| where SyslogMessage has_any (SapParents) and SyslogMessage has_any (ShellChildren)
| where SyslogMessage has "EXEC" or Facility == "auth" or ProcessName in~ (SapParents)
| project TimeGenerated, Computer, ProcessName, SyslogMessage, Source="Syslog";
union EDR, Sys
| order by TimeGenerated desc;

// Part 2: Inbound connections to SAP admin/management ports from external sources (CEF/firewall logs)
CommonSecurityLog
| where DestinationPort in (8000, 8001, 8005, 8013, 44300, 44301)  // adjust to your instance numbers
| where SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172."
| summarize ConnectionCount=count(), DistinctSources=dcount(SourceIP), Sources=make_set(SourceIP, 20) by DestinationIP, DestinationPort, bin(TimeGenerated, 1h)
| order by ConnectionCount desc;

Velociraptor VQL: Use this artifact across your SAP server fleet to enumerate SAP web-tier processes with suspicious children and their live network connections — useful both for hunting and for scoping an IR engagement.

-- Hunt: SAP web-tier processes with shell children or unexpected connections
LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(sapwebdisp|disp\+work|icman|jstart|igswd)'

LET children = SELECT c.Pid AS ChildPid, c.Name AS ChildName, c.Exe AS ChildExe,
       c.CommandLine AS ChildCmdline, c.Username AS ChildUser, p.Name AS ParentName, p.Pid AS ParentPid
FROM pslist() c
JOIN (SELECT Pid, Name FROM pslist() WHERE Name =~ '(?i)(sapwebdisp|disp\+work|icman|jstart|igswd)') p
ON c.Ppid = p.Pid
WHERE c.Name =~ '(?i)(sh|bash|dash|python|perl|curl|wget|nc|ncat|base64|cmd\.exe|powershell|mshta|certutil)'

LET conns = SELECT Pid, Name, Family, Type, Laddr, Lport, Raddr, Rport, Status
FROM netstat()
WHERE Name =~ '(?i)(sapwebdisp|icman|disp\+work)'
  AND Status = 'ESTABLISHED'

SELECT * FROM children
UNION ALL
SELECT Pid AS ChildPid, Name AS ChildName, '' AS ChildExe,
       format("%v:%v -> %v:%v [%v]", args=Laddr, argv=[Lport, Raddr, Rport, Status]) AS ChildCmdline,
       '' AS ChildUser, 'netstat' AS ParentName, Pid AS ParentPid
FROM conns

Bash verification and hardening script: Run on Linux SAP hosts to inventory kernel patch level, confirm internet exposure of admin services, and restrict the Web Dispatcher admin interface pending patch deployment.

#!/bin/bash
# SAP emergency exposure check + interim hardening for the Nov 2026 CVSS 10.0 patch cycle
# Run as root or sudo on each SAP host. Review output before applying iptables changes.

SID=""   # set to your SID, e.g. PRD
INST=""  # instance number, e.g. 00

echo "=== [1] Kernel / Web Dispatcher patch level ==="
for bin in /sapmnt/${SID}/exe/sapwebdisp /sapmnt/${SID}/exe/disp+work /usr/sap/${SID}/SYS/exe/run/sapwebdisp; do
  [ -x "$bin" ] && echo "-- $bin" && "$bin" -v 2>/dev/null | head -5
done

echo "=== [2] Listening SAP services (identify internet-reachable admin ports) ==="
ss -tlnp | grep -E 'sapwebdisp|icman|disp\+work|sapstartsrv' || echo "No SAP listeners found on this host"

echo "=== [3] Flag dangerous bindings (admin port 800${INST} on 0.0.0.0) ==="
ss -tlnp | grep -E ":800${INST}\b" | grep -q "0.0.0.0" && \
  echo "[!] WARNING: Web Dispatcher admin port 800${INST} bound to all interfaces" || \
  echo "[OK] Admin port not exposed on 0.0.0.0"

echo "=== [4] Interim mitigation: restrict admin port to localhost (until patched) ==="
echo "Review before uncommenting:"
echo "  iptables -A INPUT -p tcp --dport 800${INST} ! -s 127.0.0.1 -j DROP"
echo "  iptables -A INPUT -p tcp --dport 443${INST} -m conntrack --ctstate NEW -m recent --set"
echo "  iptables -A INPUT -p tcp --dport 443${INST} -m recent --update --seconds 60 --hitcount 100 -j DROP  # crude rate limit"

echo "=== [5] Recent shell children of SAP processes (quick triage, last boot) ==="
for pid in $(pgrep -f 'sapwebdisp|disp\+work|icman|jstart'); do
  for child in $(ps --ppid $pid -o pid= 2>/dev/null); do
    ps -p $child -o pid,ppid,user,comm,args
  done
done

Remediation

1. Apply the SAP Security Patch Day notes immediately. Pull the November 2026 security notes from the SAP Support Portal — Security Notes and the SAP Security Patch Day page. All four notes are rated CVSS 10.0 — there is no triage argument for deferring any of them. Kernel-level fixes for Web Dispatcher/ICM typically ship as updated kernel archives (disp+work package) rather than Support Packages; schedule a rolling restart to minimize downtime.
2. Prioritize by exposure, not by system tier. Patch internet-facing Web Dispatchers first, then any NetWeaver system reachable from user networks, then development/sandbox systems. A vulnerable QAS box reachable from the corporate LAN is still a pre-auth RCE landing zone.
3. If you cannot patch within 24 hours, reduce exposure: remove the Web Dispatcher from direct internet exposure behind a WAF/CDN that terminates TLS and normalizes HTTP (request smuggling and malformed-request flaws are often blunted by a strict fronting proxy — though this is not a guarantee), block the admin/management ports at the perimeter, and restrict ICM HTTP(S) access to required integration endpoints via ACL (icm/HTTP/auth_, Web Dispatcher wdisp/permission_table / PIT files where applicable).
4. Hunt retroactively. Review Web Dispatcher and ICM HTTP access logs (/usr/sap/<SID>/<instance>/work/dev_webdisp, dev_icm, and icmHTTP.log) for the past 30+ days: look for malformed/overlong requests, unusual header duplication (smuggling indicators), requests to nonexistent handlers returning 200/500, and any burst of requests from single external IPs. Correlate with the process-spawn detections above.
5. Rotate credentials on any host showing suspicious activity. Assume <sid>adm, database connect users, and stored RFC destinations are compromised on any host with evidence of exploitation. Treat the incident as a full IR engagement, not a patch event.
6. Validate network segmentation permanently. The Web Dispatcher admin interface and the SAP Management Console (sapstartsrv, ports 5NN13/5NN14) should never be internet-reachable under any circumstances — verify this from an external scan, not from internal assumptions.

The Bottom Line

Four simultaneous CVSS 10.0 pre-authentication flaws — two enabling code execution, one sitting on the internet edge — is the kind of SAP patch cycle that historically precedes mass exploitation. The defensive playbook is well-defined: patch the Web Dispatcher and kernel immediately, hunt for post-exploitation process and network behavior from SAP service processes, and treat any positive hit as a full compromise. Organizations that treat SAP security notes as a quarterly maintenance item will not survive this class of disclosure; the teams that win are the ones with a same-day emergency path for SAP kernel patches.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub