SAP Web Dispatcher
CVE-2025-42877
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Web Dispatcher/ICM port
-
DeliverySend crafted malformed request
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt process memory
-
ImpactCrash service, deny availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an exposed SAP Web Dispatcher, Internet Communication Manager (ICM), or SAP Content Server endpoint - typically the HTTP(S) listener used as the front-end/reverse-proxy for SAP application servers. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are stated as prerequisites; the trigger is a crafted request that exercises the logical errors causing memory corruption. The primary limiting factor is exposure: internet-facing or untrusted-network-reachable instances are at risk, while instances restricted to trusted internal networks or behind filtering substantially reduce reachable attack surface. Impact is limited to availability (service crash/DoS), with no confidentiality or integrity consequence. |
| Impact | This is a genuine but bounded priority: a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N confirms no authentication) flaw with no user interaction, which argues for easy triggering. However, the impact is availability-only (C:N/I:N/A:H) - a denial-of-service/crash of SAP Web Dispatcher, ICM, or Content Server via memory corruption (CWE-787, out-of-bounds write), not code execution or data exposure, which caps the CVSS at 7.5 (High). The exploitation signals are modest and mutually consistent: EPSS is only 0.54% (44th percentile), there is no CISA KEV listing (not confirmed actively exploited), and no public exploit identified at time of analysis. So despite the attractive unauthenticated-remote vector, there is currently no evidence of weaponization or active exploitation - the real-world risk today is a DoS exposure on internet-facing SAP front-end components rather than a full compromise. Note a limitation: memory-corruption bugs (OOB write) sometimes carry latent code-execution potential, but SAP scored impact as availability-only and nothing in the available data supports escalation beyond DoS - treat A:H/DoS as the confirmed ceiling and verify with SAP Note 3677544 if RCE concern is relevant. |
| Exploit ScenarioDerived | An attacker with network access to an internet-facing SAP Web Dispatcher or ICM endpoint sends a crafted request that triggers logical errors leading to an out-of-bounds write, corrupting memory and crashing the service. No authentication or user interaction is required, so repeated requests can keep the component offline, denying access to the SAP application landscape it fronts. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Unauthenticated memory corruption in SAP Web Dispatcher, SAP Internet Communication Manager (ICM), and SAP Content Server allows a remote attacker to crash the affected service by sending a crafted request that exercises logical errors in the code, resulting in a denial-of-service condition. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required; exploitation is bounded only by network reachability, so internet-facing or untrusted-network-exposed dispatcher/ICM/Content Server endpoints carry the highest risk. No public exploit code has been identified at time of analysis, EPSS is low at 0.54% (44th percentile), and SAP has published remediation guidance via its security notes and patch day. Impact is limited to availability (service crash/DoS) with no confidentiality or integrity consequence.
RemediationAI
Apply the fix delivered through SAP security note 3677544 (https://me.sap.com/notes/3677544) and the SAP Security Patch Day release (https://url.sap/sapsecuritypatchday); patch status is 'Patch available per vendor advisory' - follow the note for the exact patched release and binary versions for your Web Dispatcher, ICM, and Content Server deployment (no standalone fixed version number is published in this data, so do not assume one). In the interim, reduce reachability of the affected HTTP(S) listeners: restrict SAP Web Dispatcher/ICM/Content Server endpoints to trusted networks, place them behind an authenticated reverse proxy or WAF that filters malformed or oversized requests, and avoid direct internet exposure - the trade-off is reduced client reachability and potential need to update client network paths. If a component instance cannot be patched immediately, consider disabling or tightly ACLing the specific externally reachable listener/service and rate-limiting or blackholing anomalous request patterns, accepting that this is a mitigation and not a substitute for the vendor patch; monitor dispatcher and ICM processes for unexpected restarts or crash dumps as an indicator of attempted exploitation.
Affected ProductsAI
Affected components are SAP Web Dispatcher, SAP Internet Communication Manager (ICM), and SAP Content Server; the CVE is issued by SAP (cna@sap.com) and these are the products named in the vendor description and the affected CPE scope. Exploitation depends on network reachability to the exposed HTTP(S) listener used as the front-end/reverse proxy for SAP application servers, so internet-facing or untrusted-network-reachable deployments are the primary at-risk subset, while instances confined to trusted internal networks or behind filtering have substantially reduced attack surface. SAP directs remediation to security note 3677544 (https://me.sap.com/notes/3677544) and the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday); consult those bulletins for the exact supported release and patch-level mapping.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds write (CWE-787) rooted in logical errors in how SAP Web Dispatcher, the SAP Internet Communication Manager (ICM), and SAP Content Server process requests. Web Dispatcher is the HTTP(S) front-end/reverse proxy that routes traffic to SAP application servers, while ICM handles the HTTP/HTTPS communication stack inside SAP NetWeaver application servers; both sit directly on the network edge and parse untrusted client input. The logical error causes memory corruption when a specifically crafted request is processed, degrading the process to a crash rather than granting code execution or data disclosure. The CVSS vector (S:U scope unchanged, C:N/I:N/A:H) confirms the corruption is contained to availability impact only, and the PR:N qualifier confirms the trigger is unauthenticated over the network with no user interaction.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable front-end component (AV:N/PR:N/UI:N), straightforward trigger (AC:L); memory corruption yields crash/DoS only, so C:N/I:N/A:H.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
DescriptionCVE.org
SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server allow an unauthenticated user to exploit logical errors that lead to a memory corruption vulnerability. This results in high impact on the availability with no impact on confidentiality or integrity of the application.
Executive ViewAI
A high-severity denial-of-service flaw in SAP Web Dispatcher, SAP Internet Communication Manager (ICM), and SAP Content Server could allow an unauthenticated remote attacker to crash these services, potentially disrupting SAP-dependent business operations and customer-facing access. Internet-facing or partner-exposed SAP endpoints carry the highest operational risk because no authentication or user interaction is required. Although no public exploit identified at time of analysis and EPSS is low, leadership should prioritize reducing exposure and preparing to apply SAP's remediation when a vendor patch becomes available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to SAP Web Dispatcher, ICM, and Content Server endpoints; placing them behind a reverse proxy/WAF with rate limiting and malformed-request filtering; segmenting them from untrusted networks; monitoring for service crashes and unexpected restarts; preparing rapid restart/failover; and applying SAP security note guidance once available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
GitHub PoC
Exploit-DB