EUVD-2026-98184
GHSA-f9wm-r4w7-hw29
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ICM/Web Dispatcher endpoint
-
DeliveryCraft request with malformed protocol fields
-
ExploitTrigger integer underflow in parser
-
ExecutionCause memory-handling crash
-
ImpactDenial of service of SAP application
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | No special conditions beyond network reachability - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against an SAP NetWeaver or SAP Web Dispatcher instance whose Internet Communication Manager (ICM) / internal protocol component is reachable by the attacker. The required prerequisite is that the vulnerable protocol endpoint accepts the crafted request; the practical limiting factor is network exposure of the ICM/Web Dispatcher port (internet-facing deployments are at materially higher risk than internally-segmented ones). Impact is strictly limited to availability - a process crash/DoS - with no path to data disclosure, modification, or code execution, so the realistic consequence is service disruption rather than compromise. |
| Impact | All provided signals agree this is a genuine but availability-only (DoS) issue, not a top-tier priority. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 HIGH) indicates a network-reachable, low-complexity, unauthenticated flaw requiring no user interaction, with impact confined entirely to availability (C:N/I:N) - consistent with the description's 'memory-handling error, causing the affected process to crash.' No EPSS score, no CISA KEV listing, and no POC were supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; SSVC-style framing would put exploitation at 'none', automatable likely 'yes' (unauthenticated network request), but technical impact only 'partial' since confidentiality and integrity are untouched. The high CVSS is driven solely by A:H, so despite the 'HIGH' label the real-world severity is bounded: a successful attack degrades or restarts a service rather than compromising data or gaining code execution. Note the metadata inconsistency: the tag reads 'Integer Overflow' while the assigned weakness is CWE-191 (Integer Underflow) - verify the exact arithmetic flaw with SAP note 3765424. Net assessment: patch on a normal availability-risk cadence; prioritize higher only for internet-exposed SAP Web Dispatcher / ICM endpoints where an unauthenticated crash directly impacts business continuity. |
| Exploit ScenarioDerived | An attacker with network reach to an exposed SAP Web Dispatcher or NetWeaver Internet Communication Manager (ICM) sends a specially crafted request to the internal protocol component containing malformed field values. The malformed fields trigger an integer underflow (CWE-191) and a memory-handling error that crashes the worker process, producing a denial of service with no authentication or user interaction required. No public exploit code is identified at time of analysis, but the AV:N/AC:L/PR:N vector makes reliable triggering straightforward once the vulnerable field parsing is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote denial of service affects SAP NetWeaver and SAP Web Dispatcher deployments in which the Internet Communication Manager (ICM) internal protocol component can be reached by an attacker; a specially crafted request carrying invalid field values triggers an integer underflow (CWE-191) that corrupts memory handling and crashes the affected process. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning any network-reachable instance is exposed with no credentials or user interaction required, but the consequence is strictly service disruption - there is no confidentiality or integrity impact and no demonstrated path to data disclosure, tampering, or code execution. Exploitation status: no public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the practical risk driver is therefore exposure of the ICM/Web Dispatcher protocol endpoint rather than active exploitation, with internet-facing systems materially more at risk than segmented internal ones.
RemediationAI
Primary fix: apply the corrections delivered through SAP Security Note 3765424, obtained via the SAP Security Patch Day page at https://url.sap/sapsecuritypatchday and the note itself at https://me.sap.com/notes/3765424 - patch availability is confirmed by the vendor advisory, but no exact patched release, support package, or kernel version is specified in the supplied data, so the precise target level must be read from the note (do not assume a version). Because the defect is reached through the ICM's request-parsing path, no configuration toggle fully eliminates it; where immediate patching is not possible, the highest-value compensating control is to remove unnecessary network reachability of the ICM and Web Dispatcher listeners - block direct inbound access to the HTTP/HTTPS ports from untrusted networks, front the component with a reverse proxy or load balancer that only forwards well-formed requests, and restrict access to known client subnets via firewall or SAP ACLs. Trade-offs: port blocking and network segmentation will interrupt legitimate inbound application traffic and any external integrations that terminate on the Web Dispatcher, so allowlist the required source addresses before restricting; a generic WAF offers only partial protection because the malformed fields are handled by an internal protocol component rather than necessarily conforming to standard HTTP semantics, so it may not detect the triggering request and can add latency. If a crash is observed, the standard operational mitigation is to enable automatic restart/monitoring of the ICM or Web Dispatcher work processes to shorten the outage window, accepting that repeated requests can sustain the denial of service until the note's fix is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 7 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Internet Communication Manager (ICM) is SAP's protocol-handling process inside SAP NetWeaver Application Server and the standalone SAP Web Dispatcher, responsible for accepting and parsing inbound HTTP/HTTPS and related internal protocol traffic before handing requests to the application. The root cause class is CWE-191 (Integer Underflow): the component does not properly validate certain fields in specially crafted requests, so a length or counter value is decremented or subtracted below its valid minimum, producing a wrapped or negative value that is then used in a memory-handling operation (such as a size calculation, bound check, or buffer offset). The resulting inconsistency causes the worker process to fault and terminate - an availability-only defect consistent with the supplied CWE tag (Integer Overflow, i.e. the integer-arithmetic family) and with the assessed vector, which shows A:H with C:N/I:N. Because the crash is confined to a single worker/process rather than corrupting memory in an exploitable way, the assessed impact does not extend to remote code execution, and the CPE entry identifies the affected component generically as the "SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)" product, with version information carried by the vendor's patch notes rather than by the CPE string.
Know when Sap Netweaver And Sap Web Dispatcher Internet Communication Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network request to the ICM parser (AV:N/AC:L/PR:N/UI:N); only a process crash results, so C:N/I:N/A:H with unchanged scope.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
DescriptionCVE.org
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application.
Executive ViewAI
SAP NetWeaver and SAP Web Dispatcher deployments are exposed to an unauthenticated remote denial-of-service vulnerability (CVE-2026-58249, CVSS 7.5) that can crash the affected service, disrupting availability of business-critical SAP applications. While there is no risk of data disclosure, tampering, or code execution, internet-facing instances are at elevated risk and no vendor-released patch identified at time of analysis, making exposure reduction the primary defense. Leadership should prioritize identifying and securing externally reachable SAP endpoints to prevent operational downtime.
Restrict network access to ICM/Web Dispatcher endpoints to trusted IP ranges, disable ICM if not required, deploy WAF with custom rules to block malformed requests, implement rate limiting, monitor logs for crashes, and maintain offline backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB