Bleepingcomputer SAP Issues Critical Patches for OAuth2 SSRF and Other Vulnerabilities
Article Content
- •CVE-2026-89111 is a critical OAuth2 SSRF vulnerability allowing credential theft.
- •SAP has released patches for 20 vulnerabilities, including four classified as critical.
- •Immediate patch application is recommended to protect against potential exploitation.
On October 13, 2026, SAP released security patches addressing 20 vulnerabilities, including a maximum-severity OAuth2 SSRF flaw (CVE-2026-89111) in the Cloud SDK for Python. This vulnerability allows remote attackers to exfiltrate client credentials by manipulating the tenant_subdomain parameter, impacting multi-tenant applications. Other critical vulnerabilities include CVE-2026-89110, which allows unauthorized access to SAP NetWeaver Visual Composer, and CVE-2026-89108, enabling admin-level control in SAP Manufacturing Integration and Intelligence. SAP advises immediate patch application to mitigate these risks. The vulnerabilities affect various SAP products, including S/4HANA and SuccessFactors. No has been confirmed yet, but the potential for rapid exploitation exists, prompting urgent action from administrators.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track SuccessFactors and CVE-2026-44756 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which SAP products are affected?
What is the severity of CVE-2026-89111?
How should we mitigate these vulnerabilities?
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…