SAP released its October 2026 security patch on Tuesday, October 13, delivering 22 new and updated security notes. Four of them address critical-severity vulnerabilities. The most severe is CVE-2026-89111, a maximum-rated flaw in the Cloud SDK for Python. Several of the bugs could allow attackers to invoke internal operations or execute code, which could lead to complete compromise of affected systems.
SAP’s patch day summary breaks the release down into 16 new security notes, four GitHub security advisories, and two updates to previously released notes. The company recommends that customers visit its support portal and apply the patches as a priority.
CVE-2026-89111 Puts Cloud SDK for Python Users at Risk
CVE-2026-89111 has a CVSS score of 10.0. It is an OAuth2 server-side request forgery (SSRF) vulnerability affecting multi-tenant BTP applications that use Cloud SDK for Python versions earlier than 0.45.2. It is tracked under GitHub advisory GHSA-4mv3-jxxm-9cx2.
SAP describes the risk in its advisory: “An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.”
Other Critical Fixes in the SAP Security Patch
Note 3797111 resolves CVE-2026-89110 (CVSS 9.9). This is a broken access control issue in certain portal functionality of NetWeaver Visual Composer, version VC70RUNTIME 7.50.
Note 3805589 fixes CVE-2026-89107 (CVSS 9.9), a code injection bug in S/4HANA’s Manage Substitution/Validation Rules. It affects S4CORE versions 105 through 109.
Note 3798788 covers CVE-2026-89108 (CVSS 9.1), a missing authorization check in the Configuration Service of SAP Manufacturing Integration and Intelligence (XMII 15.4 and 15.5).
High-Severity Vulnerabilities
Three notes are rated high. Note 3800517 patches CVE-2026-89113 (CVSS 8.8), an SQL injection flaw in Commerce Cloud’s OOTB code (COM_CLOUD 2211-JDK21).
Note 3765424 addresses CVE-2026-58249 (CVSS 7.5), a memory corruption bug in the Internet Communication Manager of NetWeaver and Web Dispatcher. It affects a wide range of components, including HDB 2.00, KRNL64UC 7.53, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, and CONTSERV 7.53 and 7.54. It also covers WEBDISP 7.53, 7.54, 7.77, 7.93 and 9.16, and KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19 and 9.20.
Note 3626303 fixes CVE-2026-89120 (CVSS 7.1), a missing authorization check in the ABAP Platform (KERNEL 7.93 and 9.16).
Medium and Low-Severity Notes
Cross-site scripting (XSS) makes up a large share of the remaining fixes:
- CVE-2026-76972 (6.5) affects Manufacturing Integration and Intelligence (note 3798823).
- CVE-2026-89117 (6.1) affects the Enterprise Portal, EP-ADMIN 7.50 (note 3779985).
- CVE-2026-76975 (6.1) affects the SAPUI5 Support Assistant Overlay (note 3794572).
- CVE-2026-76976 (5.4) affects NetWeaver AS ABAP applications based on SAP GUI for HTML (note 3671819).
- CVE-2026-89106 (4.4) affects SAPUI5 (note 3799054).
Two updated notes also deal with older issues. Note 3689080, first released in March 2026, covers CVE-2026-24316 (6.4), an SSRF flaw in NetWeaver AS for ABAP that spans SAP_BASIS 740 through 918. Note 3629325, from September 2025, addresses CVE-2025-42938 (6.1), an XSS bug in the NetWeaver ABAP Platform.
The Enterprise Portal receives two more fixes. Note 3790401 resolves an open redirect, CVE-2026-89122 (6.1), and note 3789825 resolves an information disclosure flaw, CVE-2026-89118 (5.3). Both affect EP-RUNTIME 7.50.
The other GitHub advisories cover three open-source components:
- CVE-2026-89112 (6.5) is a broken access control flaw in CLA-Assistant versions up to 2.13.1 that exposes signers’ PII.
- CVE-2026-89116 (5.9) is an OS command injection bug in Yeoman-UI version 1.25.1 and earlier.
- CVE-2026-89105 (4.2) is an improper authentication issue in the HybridTokenAuthenticator of the cloud-security-services-integration-library, affecting versions 3.6.6 up to, but not including, 4.1.1.
Missing authorization checks were also fixed in two more products. CVE-2026-89121 (4.7) affects S/4HANA Linear Asset Management (S4CORE 109), and CVE-2026-89124 (4.3) affects Global Trade Services, edition for SAP HANA (GTSCORE 200 and 300).
The only low-rated note, 3767634, addresses CVE-2026-58242 (CVSS 3.5), an improper authorization check in Cloud Connector 2.0.
