SAP Patches Critical NetWeaver and S/4HANA Security Flaws Affecting Enterprise Systems

SAP’s Security Patch Day on October 13, 2026, addresses critical vulnerabilities found in enterprise applications, integration platforms, and developer libraries.

The October bulletin details the release, which includes 16 new security notes, four GitHub security advisories, and two updates to previously published notes, covering a total of 22 CVEs.

Four vulnerabilities are rated as Critical. The most severe among them is an OAuth2 server-side request forgery (SSRF) vulnerability in the SAP Cloud SDK for Python.

Other critical issues involve SAP NetWeaver Visual Composer, SAP S/4HANA, and SAP Manufacturing Integration and Intelligence. SAP advises prioritizing security corrections through its security-note process.

SAP Patches Critical NetWeaver Flaw

CVE-2026-89111: Rated CVSS 10.0, this vulnerability affects SAP Cloud SDK for Python versions before 0.45.2. It involves an OAuth2 SSRF vulnerability that attackers can exploit over the network without authentication or user interaction.

This could lead to severe impacts on confidentiality, integrity, and availability, extending beyond the vulnerable component’s security authority.

CVE-2026-89110: This broken access control vulnerability affects SAP NetWeaver Visual Composer (VC70RUNTIME 7.50) and is rated 9.9. Unlike the Python SDK issue, this vulnerability requires low privileges but no user interaction, posing high risks to confidentiality, integrity, and availability.

CVE-2026-89107: This flaw introduces a code injection risk in the Manage Substitution/Validation Rules functionality of SAP S/4HANA, affecting versions S4CORE 105 through 109.

Like previous vulnerabilities, it can be exploited remotely but requires only low privileges, not unauthenticated access, raising security concerns.

CVE-2026-89108: This vulnerability affects the Configuration Service in SAP Manufacturing Integration and Intelligence, specifically in versions XMII 15.4 and 15.5.

It is rated 9.1 and involves a missing authorization check; however, exploitation requires high privileges, which changes the exposure assessment.

CVE-2026-89113: Rated 8.8, this SQL injection vulnerability exists in the out-of-the-box code of SAP Commerce Cloud (COM_CLOUD 2211-JDK21). Low-privileged users can exploit it over the network, potentially causing serious impacts on confidentiality, integrity, and availability.

CVE-2026-58249: This vulnerability concerns memory corruption in the Internet Communication Manager used by SAP NetWeaver and SAP Web Dispatcher. Rated 7.5, it can be exploited without authentication via network access and has a high potential impact on availability, but it does not affect confidentiality or integrity.

CVE-2026-89120: This issue deals with a missing authorization check in the SAP ABAP Platform, affecting kernel versions 7.93 and 9.16. It has a severity score of 7.1 and primarily threatens integrity.

The remaining entries in the bulletin address vulnerabilities related to cross-site scripting, information disclosure, open redirects, authorization weaknesses, command injection, and improper authentication. SAP has also updated notes for CVE-2026-24316, an ABAP application-server SSRF vulnerability, and CVE-2025-42938, an ABAP Platform XSS vulnerability.

The bulletin does not report any active exploitation, public exploit availability, or incident attribution. Therefore, the severity scores represent assessed technical risks rather than evidence that attackers are currently exploiting these vulnerabilities.

For remediation, the bulletin directs customers to SAP’s support portal and emphasizes applying patches promptly. SAP’s published policy also recommends implementing security corrections as soon as possible and notes that patch availability may depend on maintenance status and support package eligibility.

Administrators should review individual notes for applicable corrections instead of relying solely on affected-version listings for complete installation instructions.

All CVE Details

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.