SAP announced the release of 22 new and updated security notes as part of its October 2026 Security Patch Day, including four vulnerabilities classified as critical in Cloud SDK for Python, NetWeaver Visual Composer, S/4HANA, and Manufacturing Integration and Intelligence. The company did not mention any exploitation of these flaws in real-world attacks, but recommended that users update their applications as soon as possible.
Vulnerabilities That Could Lead to Full Compromise
The highest-severity vulnerability carries the identifier CVE-2026-89111 and a CVSS score of 10 out of 10. It is an OAuth2-related SSRF vulnerability in Cloud SDK for Python and affects multitenant BTP applications. According to SAP’s advisory published on GitHub, an attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server under the attacker’s control, potentially resulting in the disclosure of customer credentials.
CVE-2026-89110 has a score of 9.9 out of 10 and is associated with an access-control flaw in certain functions in NetWeaver Visual Composer. Enterprise application security company Onapsis said that a low-privileged attacker could potentially invoke internal operations on a preconfigured remote system, which could ultimately result in full control of the system.
SAP is also addressing CVE-2026-89107 in S/4HANA, with a score of 9.9 out of 10. Under specific conditions, the flaw allows an authenticated attacker with a particular business role in Fiori applications to send specially crafted input to execute arbitrary ABAP code. The defect is caused by improper input validation during the rule-definition process.
CVE-2026-89108 carries a score of 9.1 out of 10 and results from a missing authorization check in Manufacturing Integration and Intelligence. An attacker with XMII Admin privileges can create an administrative account on the underlying Java application server, enabling full system compromise.
What Changes in Practice?
This batch combines different risks: credential disclosure through OAuth2 requests, bypassing access controls, ABAP code injection, and the creation of administrative accounts. Therefore, its impact is not limited to an individual component, but may extend to enterprise SAP systems and the operations that depend on them, depending on the products, configurations, and roles available to the attacker.
SAP also fixed high-severity vulnerabilities in Commerce Cloud, NetWeaver, and ABAP Platform that could have enabled arbitrary SQL command injection, caused a process to crash, or bypassed security restrictions. The source does not specify the affected product versions or separate update deadlines, nor does it establish the existence of active exploitation of the vulnerabilities as of the publication date.
What Users Should Review
SAP management teams should review SAP’s October 2026 security notes, identify the components actually deployed, and apply the appropriate updates in accordance with approved change-management procedures. The vulnerabilities also warrant a review of role permissions, particularly roles associated with Fiori and XMII, as well as verification of the settings for multitenant applications. Remediation priority remains dependent on the extent of each environment’s exposure, as the source does not state that all deployments are exploitable in the same way.