Vulnerabilities · 9h ago

SAP patch day exposes credential and boundary flaws

SAP's October 2026 Patch Day fixes four critical flaws across Cloud SDK for Python, NetWeaver Visual Composer, S/4HANA, and Manufacturing Integration and Intelligence, including CVE-2026-89111. SAP says the Cloud SDK bug affects multi-tenant BTP applications and can let an attacker steer an OAuth2 token request to a server they control.

In plain terms, the app can be tricked into sending its own OAuth client credentials to the wrong place. The other three bugs are boundary breaks of a different sort: broken access control in NetWeaver Visual Composer, code injection in S/4HANA Manage Substitution/Validation Rules, and a missing authorization check in MII can each let a lower-privileged user cross into admin-level control or, in the S/4HANA case, run arbitrary ABAP code.

For teams running these SAP components, the lasting issue is not just one vulnerable app but the trust material and privileges it can expose. If the Cloud SDK flaw sits inside multi-tenant BTP apps, leaked client credentials can outlive the patch and keep opening doors even after the software is updated.

CVE-2026-89111

NVD KEV

CVSS 10 CRITICAL: the SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.

CVE-2026-89110

NVD KEV

CVSS 9.9 CRITICAL: sAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality.

CVE-2026-89107

NVD KEV

CVSS 9.9 CRITICAL: sAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language.

CVE-2026-89108

NVD KEV

CVSS 9.1 CRITICAL: sAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality.

Timeline

Sources

5 sources covering this story

Entities

Part of the PlainSec briefing for 2026-10-14

Editions

Related stories