ICM WebSocket Memory Corruption: CVE-2026-76964 · CVSS 3.0 10.0 · SAP Note 3778530
Note 3778530 is the AS ABAP counterpart of the Web Dispatcher issue in Note 3778556. The Internet Communication Manager did not validate length fields in WebSocket control frames while reassembling them. As a result, a heap out-of-bounds write could occur. An unauthenticated attacker who reaches an ICM HTTP port could use it to execute code and compromise the application server. SAP rates the ICM WebSocket Memory Corruption at CVSS 10.0, HotNews. In this post, we cover exposure, the fix and what to check.
ICM WebSocket Memory Corruption: affected kernels
This issue affects kernel 7.53, 7.54, 7.77, 7.93 and 9.16 to 9.20. SAP NetWeaver AS Java, by contrast, is not affected. The fix rejects malformed frames before the ICM allocates memory. SAP delivers it via dw.sar and the SP Stack Kernel.
Workarounds and their limits
Sometimes users can reach the ICM only through a Web Dispatcher. In that case, patching that Web Dispatcher to the levels in FAQ note 3778788 works as a temporary shield. However, this assumes that nobody can reach the ICM ports directly. Verify that with a network scan rather than an architecture diagram. As a last resort, you can disable WebSocket support to block this issue, but that breaks features that depend on it.
Priority
First, patch the kernel on systems with HTTP ports exposed beyond the data centre. Then close the ICM WebSocket Memory Corruption on the rest of the landscape. In addition, combine this with the other November kernel notes. That way, you roll out one kernel patch instead of several.
Verify the result
After the rollout, check the kernel patch level of every application server, for example in transaction SM51. Also confirm that no ICM still runs an old kernel after a restart. Only then is the ICM WebSocket Memory Corruption closed across the landscape.
ICM WebSocket Memory Corruption: advisory details
Component: BC-CST-IC
SAP priority: HotNews
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 7
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3778530 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
