SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
The bugs could allow attackers to invoke internal operations and execute code, completely compromising the system.
Enterprise software maker SAP on Tuesday announced the release of 22 new and updated security notes, including four that address critical-severity vulnerabilities.
At the top of the list is CVE-2026-89111 (CVSS score of 10/10), an OAuth2 SSRF vulnerability in Cloud SDK for Python that impacts multi-tenant BTP applications.
“An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated,” SAP explains in a GitHub advisory.
Next in line is CVE-2026-89110 (CVSS score of 9.9/10), a broken access control in certain portal functionality of NetWeaver Visual Composer.
According to enterprise application security firm Onapsis, the flaw could allow “a low-privileged attacker to invoke internal operations on a preconfigured remote system” and fully compromise it.
The third critical-severity vulnerability resolved on SAP’s October 2026 Security Patch Day is CVE-2026-89107 (CVSS score of 9.9/10), a code injection issue in S/4HANA that could allow authenticated attackers to execute arbitrary ABAP code on the system.
The security defect exists because the rule definition process fails to properly validate input, allowing attackers holding a specific business role in the Fiori Applications to submit crafted input. Successful exploitation could allow attackers to take over a vulnerable system, Onapsis explains.
The fourth critical bug is CVE-2026-89108 (CVSS score of 9.1/10), a missing authorization check in Manufacturing Integration and Intelligence that could allow an attacker with XMII Admin privileges to create an administrator account on the underlying Java application server and fully compromise the system.
On Tuesday, SAP also resolved high-severity flaws in Commerce Cloud, NetWeaver, and ABAP Platform that could allow attackers to inject arbitrary SQL commands, trigger a process crash, and bypass restrictions.
SAP makes no mention of any of the newly resolved security defects being exploited in the wild. Users are advised to update their applications as soon as possible.
