SAP Security Updates - October 2026
Roundup of SAP security advisories published in October 2026.
CVE search metadata
CVE search record: CVE-2026-89107. Severity: critical. CVSS: 9.9. KEV: no. Product: S/4HANA. Brief: SAP Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-sap-security-updates/
CVE search record: CVE-2026-89108. Severity: critical. CVSS: 9.1. KEV: no. Product: Manufacturing Integration and Intelligence. Brief: SAP Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-sap-security-updates/
CVE search record: CVE-2026-89110. Severity: critical. CVSS: 9.9. KEV: no. Product: NetWeaver Visual Composer. Brief: SAP Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-sap-security-updates/
CVE search record: CVE-2026-89111. Severity: critical. CVSS: 10.0. KEV: no. Product: Cloud SDK for Python. Brief: SAP Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-sap-security-updates/
CVE search record: CVE-2026-58249. Severity: high. CVSS: 7.5. KEV: no. Brief: SAP Security Updates - October 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-10-sap-security-updates/
What's new
This roundup covers 4 SAP security vulnerabilities. CVSS base scores range from 9.1 to 10.0. None are reported as actively exploited at the time of release. The issues affect Cloud SDK for Python, Manufacturing Integration and Intelligence, NetWeaver Visual Composer, S/4HANA.
Summary
| CVE | Product | Severity | CVSS | EPSS | KEV | Source |
|---|---|---|---|---|---|---|
| CVE-2026-89107 | S/4HANA | Critical | 9.9 | no | NVD (authoritative) | |
| CVE-2026-89108 | Manufacturing Integration and Intelligence | Critical | 9.1 | no | NVD (authoritative) | |
| CVE-2026-89110 | NetWeaver Visual Composer | Critical | 9.9 | no | NVD (authoritative) | |
| CVE-2026-89111 | Cloud SDK for Python | Critical | 10.0 | no | NVD (authoritative) |
CVE-2026-89107
SAP S/4HANA's 'Manage Substitution/Validation Rules' feature contains a vulnerability where input provided to a domain-specific scripting language is not sufficiently validated. An authenticated attacker with specific privileges can submit crafted input that is interpreted as executable ABAP code, leading to arbitrary code execution and full system compromise.
Affected products:
- S/4HANA
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89107
CVE-2026-89108
SAP Manufacturing Integration and Intelligence is vulnerable to a privilege escalation flaw where an attacker with administrative privileges can execute specially crafted requests to create new accounts with elevated privileges on the underlying Java application server, potentially leading to full system compromise.
Affected products:
- Manufacturing Integration and Intelligence
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89108
CVE-2026-89110
SAP NetWeaver Visual Composer contains an authorization bypass vulnerability allowing low-privileged authenticated users to trigger internal operations on preconfigured remote systems. Successful exploitation can lead to full remote system compromise, impacting confidentiality, integrity, and availability.
Affected products:
- NetWeaver Visual Composer
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89110
CVE-2026-89111
The SAP Cloud SDK for Python is vulnerable to Server-Side Request Forgery (SSRF) during OAuth2 token requests. By manipulating the tenant_subdomain parameter in multi-tenant BTP applications, an attacker can redirect authentication traffic to a malicious server, leading to the exfiltration of sensitive client credentials.
Affected products:
- Cloud SDK for Python