Multiple security vulnerabilities in SAP business software are endangering business information. Attackers can gain access to data that should be isolated, among other things. Security patches are available for download. In total, SAP has released 16 new security advisories and 4 GitHub advisories.
As stated in the security section of the SAP website , four vulnerabilities are considered “ critical. ” For one vulnerability (CVE-2026-89111) in SAP Cloud SDK for Python, the maximum CVSS score of 10 out of 10 applies. At this point, attackers can manipulate the tenant_subdomain parameter in an unspecified way within the context of OAuth2.
Because the SDK, due to an error, incorporates this value into the URL for the token request without checking it, the application is forced to send its client credentials (secrets) to a server controlled by the attacker. With these credentials, they gain access to all resources for which the application is authorized (e.g., data in S/4HANA, SuccessFactors, or other BTP services). SAP Cloud SDK for Python 0.45.2 is intended to protect against this.
Due to faulty access control, attackers with low user privileges can gain unauthorized access to SAP NetWeaver Visual Composer and completely take over systems (CVE-2026-89110 “ critical ”). If attackers are logged in, they can trigger errors in SAP S/4HANA with specially crafted requests and thus execute malicious code (CVE-2026-89107 “ critical ”). If attackers successfully exploit a vulnerability (CVE-2026-89108 “ critical ”) in SAP Manufacturing Integration and Intelligence, they can compromise systems as an administrator.
Furthermore, SAP Commerce Cloud, SAP NetWeaver with SAP Web Dispatcher, and SAP ABAP Platform are among the vulnerable systems. So far, there are no indications from the software manufacturer that attackers are already exploiting the security vulnerabilities. However, this can change quickly, so administrators should react promptly and install the patches.
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
