SAP October patches fix CVSS 10 Cloud SDK flaw and critical S/4HANA bugs

SAP published its monthly Security Patch Day release on October 13, 2026, fixing several critical vulnerabilities across its enterprise portfolio, including a maximum-severity flaw in the SAP Cloud SDK for Python and code injection in SAP S/4HANA. According to SAP's advisory page, four entries are rated critical, with CVSS scores ranging from 9.1 to 10.0. Security firm Onapsis, whose researchers reported several of the issues, counts 21 new and updated SAP Security Notes this month, including three HotNews and four High Priority notes; the SDK flaw is tracked through a GitHub security advisory rather than a standard SAP Note.

What happened

The most severe issue, CVE-2026-89111 (CVSS 10.0), is a server-side request forgery flaw in SAP Cloud SDK for Python versions before 0.45.2, SAP's advisory page shows. According to SecurityOnline, the bug affects multi-tenant SAP BTP applications: an attacker who controls a tenant subdomain value can redirect OAuth2 token requests to their own server, which SAP says can allow client credentials to be exfiltrated without authentication. SAP reports no exploitation in the wild, the outlet said.

Two more flaws are rated CVSS 9.9. CVE-2026-89107 is a code injection vulnerability in the SAP S/4HANA Manage Substitution/Validation Rules functionality. Onapsis explains that users with a specific Fiori business role can submit crafted input that the rule processing logic interprets as executable ABAP code, potentially leading to complete system compromise. CVE-2026-89110 is a broken access control flaw in SAP NetWeaver Visual Composer that, according to Onapsis, lets a low-privileged attacker invoke internal operations on a preconfigured remote system.

Technical details

The fourth critical entry, CVE-2026-89108 (CVSS 9.1), affects the configuration service of SAP Manufacturing Integration and Intelligence (XMII 15.4 and 15.5). Onapsis says an authenticated XMII administrator with network access to specific endpoints could create an account with administrative privileges on the underlying Java application server and use it to fully compromise the system.

Among high-priority fixes, SAP lists a SQL injection flaw in SAP Commerce Cloud (CVE-2026-89113, CVSS 8.8), which Onapsis says authenticated attackers can trigger through list API parameters, and a memory corruption issue in the NetWeaver Internet Communication Manager and SAP Web Dispatcher (CVE-2026-58249, CVSS 7.5). According to Onapsis, the latter lets an unauthenticated attacker crash the process, but only on installations with HTTP/2 enabled.

Who is affected

Organizations running S/4HANA, NetWeaver portals with Visual Composer, SAP MII, SAP Commerce Cloud, or custom multi-tenant BTP applications built with the Python Cloud SDK should review the release. The remaining notes cover medium- and low-severity issues, including cross-site scripting in SAPUI5 and NetWeaver Enterprise Portal.

What to do

Administrators should prioritize the critical notes. SecurityOnline advises updating the Cloud SDK for Python in every multi-tenant BTP application and then rotating OAuth2 client credentials. For the S/4HANA flaw, Onapsis notes that SAP's workaround is to deactivate the affected OData service, which blocks rule changes in related Fiori apps. For Visual Composer, the patch enables a data-service allowlist by default; Onapsis says this setting can also be enabled manually before patching. SAP lists no workaround for the MII issue.