Back Securityweek SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
Enterprise software maker SAP on Tuesday announced the release of 22 new and updated security notes, including four that address critical-severity vulnerabilities.
At the top of the list is CVE-2026-89111 (CVSS score of 10/10), an OAuth2 SSRF vulnerability in Cloud SDK for Python that impacts multi-tenant BTP applications.
“An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated,” SAP explains in a GitHub advisory.
in line is CVE-2026-89110 (CVSS score of 9.9/10), a broken access control in certain portal functionality of NetWeaver Visual Composer.
According to enterprise application security firm Onapsis, the flaw could allow “a low-privileged attacker to invoke internal operations on a preconfigured remote system” and fully compromise it.
The third critical-severity vulnerability resolved on SAP’s October 2026 Security Patch Day is CVE-2026-89107 (CVSS score of 9.9/10), a code injection issue in S/4HANA that could allow authenticated attackers to execute arbitrary ABAP code on the system.
The security defect exists because the rule definition process fails to properly validate input, allowing attackers holding a specific business role in the Fiori Applications to submit crafted input. Successful exploitation could allow attackers to take over a vulnerable system, Onapsis explains .
The fourth critical bug is CVE-2026-89108 (CVSS score of 9.1/10), a missing authorization check in Manufacturing Integration and Intelligence that could allow an attacker with XMII Admin privileges to create an administrator account on the underlying Java application server and fully compromise the system.
On Tuesday, SAP also resolved high-severity flaws in Commerce Cloud, NetWeaver, and ABAP Platform that could allow attackers to inject arbitrary SQL commands, trigger a process crash, and bypass restrictions.
SAP makes no mention of any of the newly resolved security defects being exploited in the wild. Users are advised to update their applications as soon as possible.
Related: Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
Related: Adobe Patches 176 Vulnerabilities Across 11 Products
Related: Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Related: Critical SonicWall Vulnerability Exploited Days After Disclosure
Ionut Arghire is an international correspondent for SecurityWeek.
More from Ionut Arghire
$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
Cyberattack Prompts Grocery Giant Ahold Delhaize to Disconnect Systems
Refrigeration Controller Hack Spoils Food Across European Supermarkets
Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
iRhythm Data Breach Impacts at Least 360,000 People
Critical SonicWall Vulnerability Exploited Days After Disclosure
Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
Google Domains Impacted by Recent ccTLD Hijacks
Employee Arrested After Listening Device Found in OpenAI Conference Room, FBI and the Company Say
Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
Adobe Patches 176 Vulnerabilities Across 11 Products
Google Partially Reverses Chrome Bug Bounty Cuts
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns
XWorm RAT Evolves Into Surveillance Platform
AI Turns Familiar Cyberattacks Into a Race Against Time
Flipboard Whatsapp Whatsapp Email
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
