SAP Security Notes, October 2026

Inprosec, through its services such as the SAP Security Assessment, helps its clients improve the security levels of their SAP systems.

October 2026 Notes

Summary and Highlights of the Month

Full Details

The full details of the most relevant notes are as follows:

• OAuth2 SSRF vulnerability in SAP Cloud SDK for Python (GHSA-4mv3-jxxm-9cx2): (Note: This is a GitHub Security Advisory affecting an open-source library, rather than a standard SAP Note). The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomainparameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. Version 0.45.2validates the Tenant_subdomainvalue against RFC 1123 DNS label rules before substituting it into a token URL. Consumer applications can mitigate the vulnerability by validating tenant_subdomainagainst a known allowlist of registered tenant subdomains before passing it to any SDK call. A temporary workaround is available. CVSS v3 Base Score 10.0/10 [CVE-2026-89111].
• Broken Access Control in SAP NetWeaver Visual Composer (3797111): SAP NetWeaver Visual Composer is affected by a Broken Access Control vulnerability. Successful exploitation could result in a high impact on the confidentiality, integrity, and availability of the system. CVSS v3 Base Score 9.9/10 [CVE-2026-89110].
• Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) (3805589): SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system. A temporary workaround is available. CVSS v3 Base Score 9.9/10 [CVE-2026-89107].
• Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) (3798788): SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability. CVSS v3 Base Score 9.1/10 [CVE-2026-89108].
• SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) (3800517): SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application’s database, resulting in a high impact on confidentiality, integrity and availability of the application. A temporary workaround is available. CVSS v3 Base Score 8.8/10 [CVE-2026-89113].
• Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) (3765424): SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application. A temporary workaround is available. CVSS v3 Base Score 7.5/10 [CVE-2026-58249].
• Missing authorization check in SAP ABAP Platform (3626303): A regression caused by an API change in the SAP ABAP platform re-introduces a previously fixed authorization weakness. The session manager can be opened in individual transaction mode, even from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in a high impact on integrity and low impact on confidentiality. It does not affect availability. CVSS v3 Base Score 7.1/10 [CVE-2026-89120].

Reference Links

• SAP Security Patch Day – October 2026
• SAP Security Notes: October 2026 Patch Day – Onapsis

Affected Resources