October 2026

support.sap.com • October 13, 2026

This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the support portal and applies patches on priority to protect their SAP landscape. On 13 th of October 2026, SAP security patch day saw the release of 16 new security notes and 4 GitHub security advisories. There are 2 updates to previously released security notes.

[ CVE-2026-89111 ] OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

Library - SAP Cloud SDK for Python Version(s) =3.6.6 < 4.1.1

[ CVE-2026-58242 ] Improper Authorization check in SAP Cloud Connector

Product - SAP Cloud Connector Version(s) - SAP_CLOUD_CONNECTOR 2.0

To know more the security researchers and research companies who have contributed for security patches of this month, visit here . SAP is committed to delivering trustworthy products and cloud services. Secure configuration is essential to ensuring secure operation and data integrity. We have therefore documented security recommendations that are consolidated in this document to help you configure the best security for your SAP portfolio. Archived blogs from years are available here . If you have any or feedback this post, you can write to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SAP Issues Critical Patches for OAuth2 SSRF and Other Vulnerabilities On October 13, 2026, SAP released security patches addressing 20 vulnerabilities, including a maximum-severity OAuth2 SSRF flaw (CVE-2026-89111) in the Cloud SDK for Python. This vulnerability allows remote attackers to exfiltrate client credentials by manipulating the tenant_subdomain parameter, impacting multi-tenant applications. Other critical vulnerabilities include CVE-2026-89110, which allows unauthorized access to SAP NetWeaver Visual Composer, and CVE-2026-89108, enabling admin-level control in SAP Manufacturing Integration and Intelligence. SAP advises immediate patch application to mitigate these risks. The vulnerabilities affect various SAP products, including S/4HANA and SuccessFactors. No has been confirmed yet, but the potential for rapid exploitation exists, prompting urgent action from administrators. 2 sources 72

Extracted Entities

October 2026

The full story

Extracted Entities

CVEs (2)

CWE Weaknesses (1)

Domains (1)

Email Addresses (1)

Platforms (2)

Vulnerabilities (2)