SAP October Security Updates Address Critical Code Injection and SSRF Flaws
SAP's October 2026 security updates tackle 16 new vulnerabilities, including four critical issues like code injection in S/4HANA and SSRF in SAP Cloud SDK.
SAP has rolled out its October 2026 security updates, patching a total of 16 new vulnerabilities, with four of them rated as critical. This release also includes four GitHub security advisories and updates to two previously issued notes. The vulnerabilities span across key SAP products and components, including S/4HANA, NetWeaver, Web Dispatcher, Commerce Cloud, and various development libraries, underscoring the broad impact of these security fixes.
The most severe flaw, CVE-2026-89111, is a critical OAuth2 server-side request forgery (SSRF) vulnerability in the SAP Cloud SDK for Python, carrying a perfect CVSS score of 10.0. Affecting versions prior to 0.45.2, this flaw can be exploited in multi-tenant SAP Business Technology Platform applications. An attacker who can control the tenant_subdomain parameter can redirect token requests to an attacker-controlled server, potentially leading to the theft of client credentials.
Another critical vulnerability, CVE-2026-89107 (CVSS 9.9), resides in the Manage Substitution/Validation Rules feature within SAP S/4HANA. Versions S4CORE 105 through 109 are affected. The vulnerability arises from insufficient input validation in the scripting language used for business rules. An authenticated attacker with specific privileges can inject crafted input that the system interprets as executable ABAP code, granting them significant control over the affected system and posing risks to data privacy, accuracy, and service availability.
Further critical issues include CVE-2026-89110, a broken access control flaw in SAP NetWeaver Visual Composer (VC70RUNTIME 7.50), rated 9.9, and CVE-2026-89108, a missing authorization check in the Configuration Service of SAP Manufacturing Integration and Intelligence (XMII) versions 15.4 and 15.5, with a CVSS score of 9.1.
Beyond the critical vulnerabilities, SAP also addressed a high-severity memory corruption flaw (CVE-2026-58249) in the Internet Communication Manager component of SAP NetWeaver and SAP Web Dispatcher. While rated High (CVSS 7.5), this vulnerability can lead to a crash of the affected process, impacting service availability. The affected versions span multiple kernel and Web Dispatcher releases, as well as other components like Content Server and SAP Extended Application Services.
In total, SAP's October patch cycle addresses four critical, three high, 14 medium, and one low severity vulnerability. Administrators are urged to review the specific security notes and affected versions to prioritize patching efforts across their SAP environments. The breadth of affected products highlights the interconnected nature of SAP systems and the importance of a comprehensive patch management strategy.
This patch release is crucial for organizations relying on SAP solutions to maintain the security and integrity of their business operations. The presence of critical code injection and SSRF vulnerabilities underscores the ongoing threat landscape targeting enterprise software and the need for diligent security practices.