CVE-2007-3615: SAP Internet Communication Manager

High severity, CVSS 7.8. EPSS: 2.4% chance of exploitation in the next 30 days.

Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remote attackers to cause a denial of service (process crash) via a URI of a certain length that contains a sap-isc-key parameter, related to configuration of a web cache.

Affected products

• SAP Internet Communication Manager: any version
• SAP SAP Web Application Server: version 6.10 only; version 6.20 only; version 6.40 only; version 7.0 only; version 7.0.10 only

Published 2007-07-06. Last modified 2026-06-16.