SAP patches maximum

Feeds.4Sysops •IT News • October 13, 2026

A maximum-severity flaw in SAP’s Cloud SDK for Python could let unauthenticated attackers steal application credentials by redirecting OAuth2 token requests. SAP patched the vulnerability, CVE-2026-89111, in its October security updates; customers unable to update immediately can restrict the affected tenant value with an allowlist. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SAP Cloud SDK Flaw Exposes OAuth2 Credentials to Attackers SAP has disclosed a critical vulnerability in its Cloud SDK for Python, tracked as CVE-2026-89111, which carries a CVSS score of 10.0. This maximum-severity flaw allows remote, unauthenticated attackers to exfiltrate OAuth2 client credentials from multi-tenant applications on the SAP Business Technology Platform (BTP) by manipulating the tenant_subdomain parameter. The vulnerability was patched in version 0.45.2, released on August 21, 2026, but subsequent versions had inconsistencies in the validation check. As of now, there are no confirmed reports of exploitation in the wild, but organizations using the affected SDK are advised to prioritize remediation due to the potential for lateral movement and data exfiltration. SAP's October 2026 Security Patch Day also addressed 20 other vulnerabilities across various products, including two additional critical flaws. 12 sources 61

Extracted Entities

SAP patches maximum

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)