SAP Security Patch Day October 2026 Fixes CVSS 10 Cloud SDK Flaw and Three More Critical Bugs
Do Son 
TL;DR
SAP Security Patch Day for October 2026 addressed 20 CVEs on October 13. Four of them are critical vulnerabilities, led by a CVSS 10.0 flaw in the SAP Cloud SDK for Python. Two more critical bugs in NetWeaver Visual Composer and S/4HANA score 9.9.
- Total: 5 CVEs
- Severity: 4 Critical · 1 High
- Actively exploited: None confirmed
- Highest severity: 10.0 (Critical · CVSSv3) — CVE-2026-89111
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-89111 | 10 | CWE-918 | Not exploited |
| CVE-2026-89110 | 9.9 | CWE-749 | Not exploited |
| CVE-2026-89107 | 9.9 | CWE-94 | Not exploited |
| CVE-2026-89108 | 9.1 | CWE-862 | Not exploited |
| CVE-2026-89113 | 8.8 | CWE-89 | Not exploited |
Why It Matters
SAP systems run finance, supply chain and HR for many of the world’s largest firms. As a result, a single flaw can expose core business data. This month’s critical bugs could lead to stolen cloud credentials, arbitrary code execution and full takeover of connected systems.
The October SAP Security Patch Day also fixes one high-severity flaw that needs no login. CVE-2026-58249 (CVSS 7.5) lets an unauthenticated attacker crash SAP NetWeaver and SAP Web Dispatcher processes with a malicious request.
How the Attacks Work
CVE-2026-89111: SAP Cloud SDK for Python (CVSS 10.0)
This server-side request forgery flaw affects multi-tenant BTP applications. An attacker who controls a tenant subdomain value can redirect OAuth2 token requests to their own server. According to SAP’s advisory, this ends with “client credentials to be exfiltrated.” The attack needs no login.
CVE-2026-89110: SAP NetWeaver Visual Composer (CVSS 9.9)
Visual Composer skips some authorization checks in portal functions. A low-privileged attacker could then trigger internal operations on a preconfigured remote system. SAP warns: “Depending on the remote connection configuration, this could lead to a full compromise of the remote system.”
CVE-2026-89107: SAP S/4HANA (CVSS 9.9)
The Manage Substitution/Validation Rules app does not properly check rule input. As a result, crafted input “is interpreted as executable ABAP code by the rule processing logic.” SAP says this can result in “full compromise of the affected system.”
Other notable fixes
- CVE-2026-89108 (CVSS 9.1): an MII administrator could create an elevated account on the underlying Java server.
- CVE-2026-89113 (CVSS 8.8): a SQL injection flaw in SAP Commerce Cloud could expose or alter database records.
- CVE-2026-89120 (CVSS 7.1): SAP notes that “a regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness.”
Exploitation status
SAP does not report exploitation in the wild for any of these flaws. Likewise, no public proof-of-concept has been confirmed.
Affected Versions
SAP lists the exact affected releases in each Security Note, which requires a support login. The key notes are:
- SAP Note 3797111: NetWeaver Visual Composer (CVE-2026-89110)
- SAP Note 3805589: S/4HANA Manage Substitution/Validation Rules (CVE-2026-89107)
- SAP Note 3798788: Manufacturing Integration and Intelligence (CVE-2026-89108)
- SAP Note 3800517: SAP Commerce Cloud (CVE-2026-89113)
The Cloud SDK for Python flaw is tracked through a GitHub security advisory for SAP’s open-source libraries, rather than a standard SAP Note.
Patch and Mitigation Steps
- Review the SAP Security Patch Day portal and apply critical notes first.
- Update the SAP Cloud SDK for Python in every multi-tenant BTP app, then rotate OAuth2 client credentials.
- Patch NetWeaver Visual Composer and review its remote system connections.
- Restrict who holds S/4HANA rule-definition rights and MII administrator access.
- Patch internet-facing Web Dispatcher instances to block the unauthenticated crash bug.
Overall, this SAP Security Patch Day carries four critical fixes that reach cloud apps, portals and core ERP. Teams should treat them as urgent.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
