CONTACT AN SAP EXPERT
Search
CONTACT AN SAP EXPERT
ICMAD Report

The ICMAD Vulnerabilities: Who Is at Risk and How to Protect Your Business-Critical SAP Applications

/in /by

Onapsis Research Labs’ thorough investigation of HTTP Response Smuggling over the last year led to the recent identification of the ICMAD vulnerabilities.
 
Read the threat report from Onapsis Research Labs to understand:

  • What the ICMAD vulnerabilities are
  • The potential business impact of exploitation, including session hijacking, theft of credentials, and full SAP system takeover
  • Recommendations to protect your business-critical SAP systems 
  • New research into HTTP Response Smuggling techniques

Onapsis worked closely with SAP’s Product Security Response Team to discover and patch these critical vulnerabilities. Both companies believe that all unpatched SAP applications are at risk and strongly advise all impacted organizations to prioritize patching these affected systems as soon as possible.

For more information about the ICMAD SAP vulnerabilities, deep research from the Onapsis Research Labs, and an executive threat briefing, visit onapsis.com/icmad.

SAP Business Risk Illustration: Cyber Risk Assessment

/in /by
40,000+ ORGANIZATIONS USING SAP ARE AT RISK OF RECON VULNERABILITY. Successful Exploit Could Allow Unauthenticated Full System Access; Impact Business Operations and Regulatory Compliance

ERP Systems and Mission-Critical Applications at Risk

A recent IDC survey of 430 IT decision makers titled, “ERP Security: The Reality of Business Application Protection” found that 64% of organizations have reported an ERP system—SAP and Oracle E-Business Suite—breach in the past 24 months. The research further suggests that these ERP systems are increasingly under attack for critical data. Among companies whose ERP systems have been breached in the last 24 months, the information compromised the most includes sales data (50%), customer personally identifiable information (41%), intellectual property (36%) and financial data (34%).  Respondents ranked financial and sales data as the two most critical types of compromised data. 

New RECON Vulnerability in SAP

The SAP July 2020 Security Notes include a fix for a critical vulnerability – CVSS score of 10 out of 10—named RECON (Remotely Exploitable Code On NetWeaver). This is a very serious vulnerability affecting a default component present in every SAP application running the SAP NetWeaver Java technology stack. This technical component is used in many SAP business solutions, including SAP S/4HANA, SAP SCM, SAP CRM, SAP CRM, SAP Enterprise Portal, SAP Solution Manager (SolMan)and others putting more than 40,000 organizations using SAP at risk.

The RECON vulnerability is particularly dangerous because many of the affected solutions are often exposed to the internet to connect companies with business partners employees and customers which significantly reduces the complexity of a remote attack.

Business Impact of Exploits Against RECON

If exploited, an unauthenticated attacker (no username or password required) can create a new SAP user with maximum privileges, bypassing all access and authorization controls (such as segregation of duties, identity management and GRC solutions) and gaining full control of SAP systems. This could allow them to perform many malicious activities, including the ability to modify financial records, view personally identifiable information (PII), corrupt data, delete or modify logs and traces and other actions that put essential business operations at risk. Because of the type of unrestricted access an attacker could obtain, this vulnerability may also constitute a deficiency in an enterprise’s IT controls for regulatory mandates – potentially impacting financial (Sarbanes-Oxley) and privacy (GDPR) compliance.

Assess Your SAP Systems Today

Are your mission-critical SAP systems and applications susceptible to RECON and other vulnerabilities? Onapsis Risk Assessment to identify and other security issues that put your business is at risk

The results Onapsis delivers will help:

  • Identify existing vulnerabilities
  • Prioritize and expedite remediation plans
  • Reduce the overall attack surface
  • Protect your mission-critical applications

Discovery and assessment is run remotely, takes less than two hours and does not require installation of software or access to production systems.

For more information about the RECON vulnerability, read the Onapsis Threat Report

Cyber Tech Talk Series - Transformation Takeaways: 4 Learnings From Industry Leaders

/in /by

Request on Demand Video 

Many organizations have correctly realized that security needs to be considered from the start of major digital transformation projects, and have started including security leaders in project planning and execution. However, most security leaders lack the visibility and/or understanding of SAP they need to effectively measure risk and enforce security baselines for the project. Hear from key industry leaders on the importance of SAP security and how to eliminate this blindspot so security leaders can understand risk and respond accordingly.

How to Secure Your Business-Critical SAP Applications Against Modern Ransomware

/in /by

SAP & Onapsis Executive Fireside Chat


In this on-demand fireside chat, Richard Puckett, CISO of SAP, and Mariano Nuñez, CEO of Onapsis, talk about today’s sophisticated and dynamic ransomware attacks and the key actions, best practices and controls you should implement to mitigate your business’s risk.

Watch this fireside chat on-demand, for a better understanding of:

  • The current state of the threat landscape and the emerging, hyper-targeted threat tactics SAP and Onapsis are observing 
  • How to prepare for a ransomware attack, addressing two primary threat vectors with three categories of control
  • Best practices around business continuity and incident response should your business suffer an attack

Utilities OG&E: Fireside Chat

/in /by

Hear from Oklahoma’s largest electric utility, Oklahoma Gas & Electric Company (OGE Energy Corp), on how they have approached their security holistically, taking familiar security best practices and implementing them at both the OT & IT level.

Read more

CIO Insights: 4 Focus Areas for 2022

/in /by

Cyber Tech Talk Series

ON DEMAND

Better understand the executive- and board-level conversations happening around business-critical application security and program blind spots. What are your CIO peers focusing on in 2022? What can CISOs, infosec leaders, and application owners do to support the office of the CIO?

Sitemap  | Terms of Use | Privacy Policy   |  Quality Policy  |  Disclosure Policy |  Security Vulnerability Reporting Guidelines |  ©2025 Onapsis  |  All rights reserved