SAP released 22 new and updated security notes for its October 2026 Security Patch Day, including four critical vulnerabilities affecting SAP Cloud SDK for Python, NetWeaver Visual Composer, S/4HANA, and Manufacturing Integration and Intelligence.
The release was announced on a Tuesday, according to SecurityWeek’s report. SAP advises customers to install the updates as soon as possible.
The available vulnerability records identify the affected components but do not provide affected or fixed version ranges. Administrators should therefore use the applicable SAP security notes to determine exposure for each deployed release rather than treating an unlisted version as safe.
OAuth2 requests can leak client credentials
The most severe issue, CVE-2026-89111, is a server-side request forgery vulnerability in SAP Cloud SDK for Python that affects multi-tenant BTP applications.
An attacker able to control the tenant_subdomain parameter can redirect OAuth2 token requests to a server under the attacker’s control. This can expose the client credentials used in those requests.
The flaw is classified as CWE-918 and has a CVSS 3.1 score of 10.0, with the vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Exploitation requires network access but no account or user interaction. The vector rates attack complexity as low and indicates high potential impact on confidentiality and integrity, without a direct availability impact.
NetWeaver flaw reaches preconfigured remote systems
CVE-2026-89110 affects portal functionality in SAP NetWeaver Visual Composer. Insufficient authorization checks allow a low-privileged attacker to invoke internal operations on a preconfigured remote system.
The eventual impact depends on the remote connection configuration. Under configurations that expose sufficiently powerful operations, exploitation could lead to full compromise of the connected system, affecting confidentiality, integrity, and availability.
The vulnerability is classified as CWE-749 and carries a CVSS 3.1 score of 9.9:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
It is remotely exploitable with low complexity and requires low privileges, but no action from another user.
Crafted S/4HANA rules can become executable ABAP code
The S/4HANA vulnerability, CVE-2026-89107, is an input-validation failure in Manage Substitution/Validation Rules.
The affected rule-definition functionality processes a domain-specific scripting language. An authenticated attacker holding the required business privileges can submit crafted input that the rule-processing logic interprets as executable ABAP code. Successful exploitation can result in arbitrary ABAP execution and full compromise of the affected system.
CVE-2026-89107 is classified as CWE-94 and has a CVSS 3.1 score of 9.9:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The attack requires network access, low privileges corresponding to the relevant business role, and no user interaction.
MII administrators can escalate into the Java application server
CVE-2026-89108 concerns missing authorization enforcement in administrative functionality within SAP Manufacturing Integration and Intelligence.
An attacker who already has MII administrator privileges can send a crafted request that provisions an account with elevated rights on the underlying Java application server. This crosses the application’s authorization boundary and can give the attacker administrative control over the underlying system.
The flaw is classified as CWE-862 and has a CVSS 3.1 score of 9.1:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Unlike the other critical issues, exploitation requires high privileges. Its critical rating reflects the potential to extend control beyond MII and compromise the confidentiality, integrity, and availability of the underlying server.
Additional fixes and exploitation status
SAP also addressed high-severity weaknesses in Commerce Cloud, NetWeaver, and ABAP Platform. Reported consequences across those fixes include SQL injection, process crashes, and bypasses of restrictions. The available reporting does not associate CVE identifiers or individual severity scores with those issues.
SecurityWeek reports that SAP’s material did not mention active exploitation of the newly fixed vulnerabilities. That is not confirmation that exploitation has not occurred: CVSS scores describe technical severity and attack conditions, not evidence of real-world attacks.
Administrators should prioritize the SAP updates, identify multi-tenant BTP applications using SAP Cloud SDK for Python, review low-privileged access to NetWeaver Visual Composer, and restrict the relevant S/4HANA business roles and MII administrative privileges to users who require them. Remote-system configurations connected to Visual Composer also warrant review because they determine the possible reach of CVE-2026-89110. These access controls can reduce exposure while patching proceeds, but they do not replace the vendor fixes.
