SAP released its October 2026 Security Patch Day, addressing 20 CVEs across SAP Cloud Platform and core products. The bulletin highlights four critical fixes, including a CVSS 10.0 flaw in the SAP Cloud SDK for Python, with two additional high-severity issues in NetWeaver Visual Composer and S/4HANA. The article notes that, at present, there is no confirmed exploitation in the wild for these flaws.
The highest-severity CVE is CVE-2026-89111 (CVSS 10.0), followed by CVE-2026-89110 and CVE-2026-89107 (CVSS 9.9 each), and CVE-2026-89108 (CVSS 9.1). Other notable fixes include CVE-2026-89113 (CVSS 8.8) and CVE-2026-89120 (CVSS 7.1). The round-up also mentions a remotely unauthenticated crash risk in CVE-2026-58249 (CVSS 7.5) affecting SAP NetWeaver and Web Dispatcher.
The article explains how the flaws operate: CVE-2026-89111 enables server-side request forgery in multi-tenant BTP apps, potentially exfiltrating client credentials without requiring login. CVE-2026-89110 and CVE-2026-89107 involve insufficient authorization or input validation allowing internal operations or the execution of ABAP code, leading to possible full compromise of affected systems. CVE-2026-89108 concerns elevated access in MII, while CVE-2026-89113 involves SQL injection risks in SAP Commerce Cloud.
SAP provides notes and mitigations (noting exact SAP Notes for affected releases) and urges applying the latest notes, updating the Cloud SDK, rotating OAuth2 credentials, and tightening access controls. While exploitation has not been publicly confirmed, organisations should treat these fixes as urgent, particularly for cloud apps, portals and ERP environments.