SAP has released security notes addressing 22 vulnerabilities across its NetWeaver, S/4HANA, and related products, highlighting four that are considered critical. The most severe is CVE-2026-89111, an OAuth2 SSRF issue in the Cloud SDK for Python that could allow an attacker controlling the tenant_subdomain parameter to redirect OAuth2 token requests to a malicious server, exfiltrating client credentials.
Next is CVE-2026-89110, a broken access control in NetWeaver that could enable authenticated attackers to execute arbitrary ABAP code, due to inadequate input validation within the rule-definition process for a Fiori Applications role. Onapsis notes that successful exploitation could enable attackers to take over a vulnerable system.
The other two critical flaws are CVE-2026-89107, a code-injection vulnerability in S/4HANA affecting Visual Composer functionality that could let a low-privileged attacker invoke internal operations on a remote system and reach full compromise, and CVE-2026-89108, a missing authorisation check in Manufacturing Integration and Intelligence that could let an XMII Admin create an administrator account on the underlying Java application server.
SAP also fixed high-severity issues in Commerce Cloud, NetWeaver, and ABAP Platform that could permit arbitrary SQL injection, process crashes, or bypassed restrictions. SAP states that none of the newly resolved defects are reported as being exploited in the wild, and it urges users to update promptly.