SAP has rolled out its October 2026 security update, addressing several high-priority vulnerabilities including code injection, missing authorization checks, and memory corruption flaws across its business-critical systems. The patch cycle includes 16 new security notes, four GitHub advisories, and two updates to previous reports—among them, four critical-severity issues that demand urgent attention from SAP operators.
What’s Affected & Severity Breakdown
The updates span key SAP environments, including S/4HANA, NetWeaver, Web Dispatcher, Commerce Cloud, and various development libraries. Across all disclosures, SAP classified four vulnerabilities as critical, three as high, fourteen as medium, and one as low in severity. One high-rated issue concerns memory corruption in the Internet Communication Manager component of SAP NetWeaver and Web Dispatcher, which leads to service disruption but not confirmed data loss or remote code execution.
High-Critical Vulnerabilities You Should Know
Among the most urgent fixes, CVE-2026-89107 reveals a code injection weakness in S/4HANA’s Substitution/Validation Rules feature. Here, users with certain business-level privileges could inject ABAP scripts via crafted inputs, potentially gaining system-wide control. CVSS score: 9.9. Other critical vulnerabilities include:
- CVE-2026-89111: An OAuth2 server-side request forgery (SSRF) in SAP Cloud SDK for Python (versions before 0.45.2), with a maximum 10.0 rating. A malicious tenant_subdomain parameter can redirect sensitive token exchanges.
- CVE-2026-89110: A broken access control issue in NetWeaver Visual Composer (VC70RUNTIME 7.50), risking unauthorized system operations.
- CVE-2026-89108: Missing authorization in the Configuration Service of Manufacturing Integration & Intelligence (XMII v15.4 & v15.5), enabling privilege escalation scenarios.
Other Notable Updates
The memory corruption flaw CVE-2026-58249 affects a wide range of modules including kernel, Web Dispatcher, HDB, and extended application services. Though rated ‘‘high’’ rather than ‘‘critical’’, it poses serious availability risks due to possible process crashes. There are also fixes for SQL injection in Commerce Cloud, numerous cross-site scripting (XSS) flaws, broken access controls, SSRF exposures, and open redirect vulnerabilities. Administrators are advised to check their versions carefully—many advisories impact multiple SAP components not present in every deployment.
Users of SAP Cloud SDK should upgrade to version 0.45.2 or newer. For those using Python applications with affected SDK versions, configurations must be audited to ensure tenant_subdomain and related settings are not exposing insecure endpoints.
This patch release also revises two earlier-disclosed vulnerabilities, including SSRF and ABAP scripting issues. Even as the critical bugs grab attention, these updated notes merit inclusion in any comprehensive patch plan.
SAP emphasized that there is no evidence these newly disclosed vulnerabilities are under active exploitation yet. Previous zero-day incidents, notably in NetWeaver Visual Composer, were tied to older flaws (e.g. CVE-2025-31324), not this month’s disclosures.
Organizations running SAP should treat the critical patches as top priority. Affected teams must map their landscape, assign fixes where needed, and deploy updates aligned with operational impact and downtime constraints.
What this means:These disclosures reinforce that SAP systems remain major targets for attackers exploiting logic flaws—especially around authorization, code input handling, and cloud credentials. With CVSS scores like 9.9 and 10.0, failure to patch could lead to full system compromise, data exfiltration, or widespread service outages. Watch not just for the critical CVEs, but also for the cumulative risk posed by multiple ‘medium’ issues like XSS and open-redirect vulnerabilities, which often serve as stepping stones into otherwise hardened networks.
