SAP patch day exposes credential and boundary flaws
SAP's October 2026 Patch Day fixes four critical flaws across Cloud SDK for Python, NetWeaver Visual Composer, S/4HANA, and Manufacturing Integration and Intelligence, including CVE-2026-89111. SAP says the Cloud SDK bug affects multi-tenant BTP applications and can let an attacker steer an OAuth2 token request to a server they control.
In plain terms, the app can be tricked into sending its own OAuth client credentials to the wrong place. The other three bugs are boundary breaks of a different sort: broken access control in NetWeaver Visual Composer, code injection in S/4HANA Manage Substitution/Validation Rules, and a missing authorization check in MII can each let a lower-privileged user cross into admin-level control or, in the S/4HANA case, run arbitrary ABAP code.
For teams running these SAP components, the lasting issue is not just one vulnerable app but the trust material and privileges it can expose. If the Cloud SDK flaw sits inside multi-tenant BTP apps, leaked client credentials can outlive the patch and keep opening doors even after the software is updated.
CVSS 9.9 CRITICAL: sAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language.
CVSS 9.1 CRITICAL: sAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality.