International threat intelligence agencies, including CISA and CERT-EU, have issued urgent security advisories regarding the ICMAD (Internet Communication Manager Advanced Desync) vulnerabilities. These critical flaws affect the SAP Internet Communication Manager (ICM), a standard component of SAP NetWeaver and the SAP Web Dispatcher, and require immediate patching to prevent full system compromise.
What is the ICMAD vulnerability?
ICMAD refers to a set of vulnerabilities (CVE-2022-22536, CVE-2022-22532, and CVE-2022-22533) that impact the SAP Internet Communication Manager. The most severe, CVE-2022-22536, is a memory corruption vulnerability that allows unauthenticated, remote attackers to fully compromise SAP systems via a single HTTP request.
- Affected Components: SAP NetWeaver Application Server (AS) ABAP, AS Java, and SAP Web Dispatcher.
- Scope: Impacts systems accessed through an HTTP gateway. Direct access to internal application servers is not affected.
- Status: There is active evidence of scanning for these vulnerabilities, making immediate remediation critical for any internet-facing SAP systems.
How to patch and mitigate ICMAD
Administrators must prioritize updating their environments to the minimum patch levels specified by SAP.
| Component | SAP Note | Mitigation Strategy |
|---|---|---|
| AS ABAP & Web Dispatcher | 3123396 | Update kernels/dispatchers; apply workaround 3137885 if needed. |
| AS Java | 3123427 | Apply patches; use workaround parameter if pipeline requests are not required. |
For Web Dispatcher installations, note 3137885 provides guidance on minimum patch levels. To apply the stop-gap workaround for Web Dispatcher, set the profile parameter wdisp/additionalconnclose to TRUE (refer to note 3138881). For AS Java, the workaround involves setting the parameter icm/handlehttppipeline_requests=FALSE.
How to detect vulnerable SAP installations
The Cybersecurity Extension for SAP provides automated discovery for vulnerable ABAP, Java, and Web Dispatcher installations. The solution performs over 1,800 security checks, including automated validation for ICMAD patches and the correct application of recommended workarounds.
Frequently Asked Questions
What is the most critical ICMAD vulnerability?
CVE-2022-22536 is the most critical vulnerability. It is a memory corruption flaw that allows unauthenticated, remote attackers to execute a single HTTP request to gain full control of an SAP system.
Are my internal SAP application servers at risk?
The ICMAD vulnerability specifically impacts the Internet Communication Manager (ICM) when accessed through an HTTP gateway, such as the Web Dispatcher. Direct access to SAP application servers is not impacted.
What should I do if I cannot patch my systems immediately?
SAP has provided specific workarounds for both ABAP and Java environments. For Web Dispatchers, set wdisp/additionalconnclose=TRUE. For AS Java, you can set icm/handlehttppipeline_requests=FALSE if HTTP pipeline requests are not required.