Prevention is key, so CSOs should focus their efforts on system hardening and mitigation. This, he said, will be more effective than chasing vulnerabilities. Finally, Reguly reminded CSOs that prioritization matters. “If you’ve developed a prioritization strategy that works for you, don’t change your process just because the media is looking for clicks,” he said.
SAP patches
The critical vulnerabilities collectively known as ICM2Shell are CVE-2026-76964 and CVE-2026-89126. Researchers at Onapsis, who discovered them, said exploitation isn’t theoretical; they provided SAP with a working exploit that achieves full, unauthenticated remote code execution end to end, running arbitrary commands as
To access the flaw, an attacker only needs network access to the HTTP/HTTPS port, says Onapsis. Because WebSocket support is enabled by default in both the ICM and the SAP Web Dispatcher, a system is exposed even if no application uses WebSocket. Some services, including default ICF services in SAP S/4HANA, accept WebSocket connections without authentication, and in others the flaw can be reached before authentication takes place. “Nothing in the chain requires an SAP user, a password or a certificate,” the researchers said.