ICM Admin Password Storage: CVE-2026-89125 · CVSS 3.0 6.0 · SAP Note 3782056
Note 3782056 covers how SAP Web Dispatcher and the ICM store passwords for their administration UIs. The files used outdated hashing. As a result, an administrator-level attacker who reads them could recover and correlate credentials. SAP rates the ICM Admin Password Storage issue at CVSS 6.0, Medium. However, the important detail is that patching does not change existing entries. In this post, we cover exposure, the fix and what to check.
ICM Admin Password Storage: are you affected
To check this exposure, search the DEFAULT and instance profiles for icm/HTTP/admin and icm/HTTP/auth entries with AUTHFILE. Values backend or system are fine, while anything else points to a password file. In addition, check icm/authfile, which defaults to $(DIR_GLOBAL)/security/data/icmauth.txt. Any line there without {PBKDF2-SHA384} uses an old hash. Lines with {SYSTEM} and {SYSTEM_GROUP}, however, are fine.
Fix and manual step
Patch the kernel or SAPWEBDISP.SAR (7.22 EXT up to 9.20). After that, new passwords use PBKDF2-SHA384. Existing users, however, keep their old hashes until you reset them. So plan the reset step explicitly, or this issue stays open. See FAQ 3842490 and hardening note 3752223.
Why old hashes matter
Admins often reuse the same password on several Web Dispatchers and ICM instances. Therefore, cracking one weak hash can open many systems. In addition, the file sits in a shared global directory on many hosts. That is why the ICM Admin Password Storage fix needs the reset, not just the patch.
What to check
First, list every authfile in use. Next, reset each admin password after the patch and confirm that the new lines start with {PBKDF2-SHA384}. Finally, restrict file system access to the authfile, which limits the ICM Admin Password Storage risk even further.
ICM Admin Password Storage: advisory details
Component: BC-CST-WDP
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 7
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Source: SAP Security Note 3782056 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
