SAP patches critical NetWeaver, S/4HANA and Cloud SDK flaws

SAP has published 22 new and updated security notes as part of its October 2026 Security Patch Day, and four of them deal with vulnerabilities rated critical. The fixes cover the Cloud SDK for Python, NetWeaver Visual Composer, S/4HANA and Manufacturing Integration and Intelligence.

The German enterprise software maker released the notes on Tuesday. It has not said that any of the flaws are being exploited in the wild.

A maximum-severity flaw in the Cloud SDK for Python

The most serious issue is CVE-2026-89111, which carries a CVSS score of 10/10. It is a server-side request forgery (SSRF) flaw in the OAuth2 handling of SAP's Cloud SDK for Python. It affects multi-tenant applications running on BTP, SAP's Business Technology Platform.

SAP described the problem in a GitHub advisory: "An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated."

An attacker who manipulates that one parameter can therefore send token requests to infrastructure they control and collect the client credentials the application uses to authenticate.

Visual Composer and S/4HANA

The second critical bug, CVE-2026-89110 (CVSS score of 9.9/10), is a broken access control issue in portal functionality of NetWeaver Visual Composer. NetWeaver is the technology platform that underpins many SAP business applications.

Enterprise application security firm Onapsis said the flaw could allow "a low-privileged attacker to invoke internal operations on a preconfigured remote system." Exploitation could lead to full compromise of that remote system.

CVE-2026-89107, also rated 9.9/10, is a code injection flaw in S/4HANA, SAP's ERP suite. Authenticated attackers could use it to run arbitrary ABAP code, the programming language used across SAP's business software.

According to Onapsis, the root cause lies in the rule definition process, which does not properly validate input. An attacker who holds a specific business role in the Fiori Applications, SAP's web-based user interface, can submit crafted input and potentially take over the vulnerable system.

Admin account creation in MII

The fourth critical vulnerability is CVE-2026-89108 (CVSS score of 9.1/10), a missing authorization check in Manufacturing Integration and Intelligence (MII).

An attacker who already holds XMII Admin privileges could use it to create an administrator account on the underlying Java application server. From there, the attacker could fully compromise the system.

High-severity fixes

The October batch also includes fixes for high-severity bugs in Commerce Cloud, NetWeaver and the ABAP Platform. Depending on the flaw, attackers could inject arbitrary SQL commands, crash a process or bypass restrictions.

SAP advises customers to apply the updates as soon as possible.

Why It Matters

SAP systems often hold the data and processes companies depend on most: finance, supply chains, manufacturing and customer records. Many of these flaws require some level of authentication or a specific role. That should not be read as low risk. Low-privileged accounts and business roles are spread across large organisations and can be phished, reused or abused by insiders. In this case, they can be enough to take over a system.

The Cloud SDK bug stands out because it targets credentials rather than code execution. In multi-tenant cloud setups, stolen client credentials could give an attacker a foothold that is harder to spot than a crashed server. Teams running BTP applications built with the Python SDK should check which version they use and whether tenant input reaches token requests.

The release lands in a busy patch week. It follows Microsoft's October Patch Tuesday and a large batch of ICS advisories from Siemens and Rockwell. That raises the familiar problem of prioritisation. Business application stacks are often patched more slowly than endpoints because of testing and uptime concerns. The cost of a missed update was shown recently when a skipped PeopleSoft patch was blamed for a major breach.

There are no reports of exploitation so far. It is worth watching whether technical write-ups or proof-of-concept code appear in the coming weeks, as that often shortens the window defenders have to patch.