SAP's October 2026 Security Patch Day shipped 22 new and updated notes. Four are critical. SAP has not reported exploitation. That is not a reason to wait on an ERP that runs finance and plant operations.
What happened
The top note is CVE-2026-89111, scored 10.0. It is an OAuth2 server-side request forgery in Cloud SDK for Python, affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect token requests to a server they run and collect client credentials.
CVE-2026-89110, scored 9.9, is broken access control in NetWeaver Visual Composer portal functions. Onapsis says a low-privileged attacker can invoke internal operations on a preconfigured remote system and take it over.
CVE-2026-89107, also 9.9, is code injection in S/4HANA Manage Substitution/Validation Rules. An authenticated user with a specific Fiori business role can submit input that the rule engine runs as ABAP. That is a full-system compromise from inside the application, not from the network edge.
CVE-2026-89108, scored 9.1, is a missing authorization check in Manufacturing Integration and Intelligence. An attacker who already has XMII Admin can create an administrator on the underlying Java application server.
High-severity notes also cover SQL injection, crashes, and restriction bypasses in Commerce Cloud, NetWeaver, and the ABAP Platform. Onapsis counted three HotNews notes and four High Priority notes in its 13 October review.
Who is affected
- Multi-tenant SAP BTP applications built with Cloud SDK for Python, for the CVSS 10 OAuth2 flaw.
- NetWeaver systems with Visual Composer portal functionality still in use.
- S/4HANA systems where users hold the Fiori role that can edit substitution and validation rules.
- Manufacturing Integration and Intelligence (XMII) installations, especially where XMII Admin is broadly assigned.
What to do now
Apply the October HotNews notes this week, starting with CVE-2026-89111 on any BTP app using Cloud SDK for Python, then the S/4HANA and NetWeaver Visual Composer notes.
After the Cloud SDK fix, rotate OAuth client credentials for affected tenants. A redirect that already fired would have sent those secrets to an attacker-controlled host. Review who holds the Fiori role behind the S/4HANA rule editor, and who holds XMII Admin. Both flaws need an insider foothold. Stolen or shared application accounts are enough.
SAP's own notes are the patch source of truth. Apply them in a maintenance window, then confirm the note status in Solution Manager or the equivalent. Do not rely on a news summary for the component list.
Source: SecurityWeek, 14 October 2026, SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities.
Also on the blog
- CVE-2026-96951: Windows MotW bypass exploited, patch by 16 Oct
- Ivanti Connect Secure CVE-2026-104935 zero-day, CVSS 8.6
- CVE-2026-74580: Linux vhost flaw gives local users root
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.