Summary and Highlights of the Month<\/h3>\n\n\n\n\n\n\n\n\n\n\nThis month there were a total of 22 notes<\/b> (16 new, 4 security advisories and 2 updates), 2 more than in September. 4 Hot News<\/b> notes were published this month, the same number as in the previous period. As for high priority notes, there are 3<\/b>, two fewer than in September. Medium and low priority notes will not be reviewed, so we will detail a total of 7 notes<\/b> (all those with a CVSS score of 7 or higher).<\/div>\n<\/div>\nWe have a total of 22 notes<\/b> for the whole month (16 new, 4 security advisories and 2 updates to notes from previous months).<\/div>\n<\/div>\nWe will review a total of 7 notes in detail, all of them high priority and Hot News:<\/div>\n\n- \nThe highest priority vulnerability of the month (CVSS <\/b>10.0<\/b><\/span>) is a Hot News. Unlike the rest, it is not a traditional SAP Note, but a GitHub Security Advisory<\/b> affecting an open-source<\/i> library, and it relates to “OAuth2 SSRF vulnerability in SAP Cloud SDK for Python”<\/b>.<\/div>\n<\/li>\n
- \nThe second note in terms of priority (CVSS <\/b>9.9<\/b><\/span>) is another Hot News and relates to “Broken Access Control in SAP NetWeaver Visual Composer”<\/b>.<\/div>\n<\/li>\n
- \nThe third note, with the same priority (CVSS <\/b>9.9<\/b><\/span>), is another Hot News and relates to “Code Injection vulnerability in SAP S\/4HANA (Manage Substitution\/Validation Rules)”<\/b>.<\/div>\n<\/li>\n
- \nThe fourth note in terms of priority (CVSS <\/b>9.1<\/b><\/span>) is the last Hot News of the month and relates to “Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)”<\/b>.<\/div>\n<\/li>\n
- \nThe fifth note we will review (CVSS <\/b><\/span>8.8<\/b><\/span>) is high priority and concerns “SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)”<\/b>.<\/div>\n<\/li>\n
- \nThe sixth note we will review (CVSS <\/b>7.5<\/b><\/span>) is high priority and concerns “Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)”<\/b>.<\/div>\n<\/li>\n
- \nThe seventh and final note we will review (CVSS <\/b>7.1<\/b><\/span>) is high priority and concerns “Missing authorization check in SAP ABAP Platform”<\/b>.<\/div>\n<\/li>\n<\/ol>\n<\/div>\nThis month the most prevalent type was “Cross-Site Scripting (XSS)”<\/b> (6\/22 in the patch day).<\/div>\n<\/div>\nThe chart shows the classification of the October notes, as well as the evolution and classification of the previous 5 months (only Sec. Tuesday \/ Patch Day notes \u2013 by SAP):<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
![\"\"](\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2026\/10\/notas-sap-octubre-2026.jpg\")
<\/p>\n
Full Details<\/h2>\n
The full details of the most relevant notes<\/b> are as follows:<\/p>\n\n- \nOAuth2 SSRF vulnerability in SAP Cloud SDK for Python (<\/b>GHSA-4mv3-jxxm-9cx2<\/u><\/b><\/a>)<\/b>: (Note: This is a GitHub Security Advisory affecting an open-source library, rather than a standard SAP Note). The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the
tenant_subdomain<\/code>parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. Version 0.45.2<\/code>validates the Tenant_subdomain<\/code>value against RFC 1123 DNS label rules before substituting it into a token URL. Consumer applications can mitigate the vulnerability by validating tenant_subdomain<\/code>against a known allowlist of registered tenant subdomains before passing it to any SDK call. A temporary workaround is available. CVSS v3 Base Score <\/b>10.0<\/b><\/span>\/10 [<\/b>CVE-2026-89111<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n- \nBroken Access Control in SAP NetWeaver Visual Composer (<\/b>3797111<\/u><\/b><\/a>)<\/b>: SAP NetWeaver Visual Composer is affected by a Broken Access Control vulnerability. Successful exploitation could result in a high impact on the confidentiality, integrity, and availability of the system. CVSS v3 Base Score <\/b>9.9<\/b><\/span>\/10 [<\/b>CVE-2026-89110<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n
- \nCode Injection vulnerability in SAP S\/4HANA (Manage Substitution\/Validation Rules) (<\/b>3805589<\/u><\/b><\/a>)<\/b>: SAP S\/4HANA (Manage Substitution\/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system. A temporary workaround is available. CVSS v3 Base Score <\/b>9.9<\/b><\/span>\/10 [<\/b>CVE-2026-89107<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n
- \nMissing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) (<\/b>3798788<\/u><\/b><\/a>)<\/b>: SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability. CVSS v3 Base Score <\/b>9.1<\/b><\/span>\/10 [<\/b>CVE-2026-89108<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n
- \nSQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) (<\/b>3800517<\/u><\/b><\/a>)<\/b>: SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application’s database, resulting in a high impact on confidentiality, integrity and availability of the application. A temporary workaround is available. CVSS v3 Base Score <\/b>8.8<\/b><\/span>\/10 [<\/b>CVE-2026-89113<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n
- \nMemory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) (<\/b>3765424<\/u><\/b><\/a>)<\/b>: SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application. A temporary workaround is available. CVSS v3 Base Score <\/b>7.5<\/b><\/span>\/10 [<\/b>CVE-2026-58249<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n
- \nMissing authorization check in SAP ABAP Platform (<\/b>3626303<\/u><\/b><\/a>)<\/b>: A regression caused by an API change in the SAP ABAP platform re-introduces a previously fixed authorization weakness. The session manager can be opened in individual transaction mode, even from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in a high impact on integrity and low impact on confidentiality. It does not affect availability. CVSS v3 Base Score <\/b>7.1<\/b><\/span>\/10 [<\/b>CVE-2026-89120<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n<\/ul>\n
<\/p>\n
Reference Links<\/strong><\/p>\nReferences from SAP and Onapsis:<\/div>\n<\/div>\n
- \n
- \nThe highest priority vulnerability of the month (CVSS <\/b>10.0<\/b><\/span>) is a Hot News. Unlike the rest, it is not a traditional SAP Note, but a GitHub Security Advisory<\/b> affecting an open-source<\/i> library, and it relates to “OAuth2 SSRF vulnerability in SAP Cloud SDK for Python”<\/b>.<\/div>\n<\/li>\n
- \n
The second note in terms of priority (CVSS <\/b>9.9<\/b><\/span>) is another Hot News and relates to “Broken Access Control in SAP NetWeaver Visual Composer”<\/b>.<\/div>\n<\/li>\n- \n
The third note, with the same priority (CVSS <\/b>9.9<\/b><\/span>), is another Hot News and relates to “Code Injection vulnerability in SAP S\/4HANA (Manage Substitution\/Validation Rules)”<\/b>.<\/div>\n<\/li>\n- \n
The fourth note in terms of priority (CVSS <\/b>9.1<\/b><\/span>) is the last Hot News of the month and relates to “Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)”<\/b>.<\/div>\n<\/li>\n- \n
The fifth note we will review (CVSS <\/b><\/span>8.8<\/b><\/span>) is high priority and concerns “SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)”<\/b>.<\/div>\n<\/li>\n- \n
The sixth note we will review (CVSS <\/b>7.5<\/b><\/span>) is high priority and concerns “Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)”<\/b>.<\/div>\n<\/li>\n- \n
The seventh and final note we will review (CVSS <\/b>7.1<\/b><\/span>) is high priority and concerns “Missing authorization check in SAP ABAP Platform”<\/b>.<\/div>\n<\/li>\n<\/ol>\n<\/div>\nThis month the most prevalent type was “Cross-Site Scripting (XSS)”<\/b> (6\/22 in the patch day).<\/div>\n<\/div>\nThe chart shows the classification of the October notes, as well as the evolution and classification of the previous 5 months (only Sec. Tuesday \/ Patch Day notes \u2013 by SAP):<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/p>\nFull Details<\/h2>\n
The full details of the most relevant notes<\/b> are as follows:<\/p>\n
- \n
- \nOAuth2 SSRF vulnerability in SAP Cloud SDK for Python (<\/b>GHSA-4mv3-jxxm-9cx2<\/u><\/b><\/a>)<\/b>: (Note: This is a GitHub Security Advisory affecting an open-source library, rather than a standard SAP Note). The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the
tenant_subdomain<\/code>parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. Version0.45.2<\/code>validates theTenant_subdomain<\/code>value against RFC 1123 DNS label rules before substituting it into a token URL. Consumer applications can mitigate the vulnerability by validatingtenant_subdomain<\/code>against a known allowlist of registered tenant subdomains before passing it to any SDK call. A temporary workaround is available. CVSS v3 Base Score <\/b>10.0<\/b><\/span>\/10 [<\/b>CVE-2026-89111<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n- \n
Broken Access Control in SAP NetWeaver Visual Composer (<\/b>3797111<\/u><\/b><\/a>)<\/b>: SAP NetWeaver Visual Composer is affected by a Broken Access Control vulnerability. Successful exploitation could result in a high impact on the confidentiality, integrity, and availability of the system. CVSS v3 Base Score <\/b>9.9<\/b><\/span>\/10 [<\/b>CVE-2026-89110<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n- \n
Code Injection vulnerability in SAP S\/4HANA (Manage Substitution\/Validation Rules) (<\/b>3805589<\/u><\/b><\/a>)<\/b>: SAP S\/4HANA (Manage Substitution\/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system. A temporary workaround is available. CVSS v3 Base Score <\/b>9.9<\/b><\/span>\/10 [<\/b>CVE-2026-89107<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n- \n
Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) (<\/b>3798788<\/u><\/b><\/a>)<\/b>: SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability. CVSS v3 Base Score <\/b>9.1<\/b><\/span>\/10 [<\/b>CVE-2026-89108<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n- \n
SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) (<\/b>3800517<\/u><\/b><\/a>)<\/b>: SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application’s database, resulting in a high impact on confidentiality, integrity and availability of the application. A temporary workaround is available. CVSS v3 Base Score <\/b>8.8<\/b><\/span>\/10 [<\/b>CVE-2026-89113<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n- \n
Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) (<\/b>3765424<\/u><\/b><\/a>)<\/b>: SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application. A temporary workaround is available. CVSS v3 Base Score <\/b>7.5<\/b><\/span>\/10 [<\/b>CVE-2026-58249<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n- \n
Missing authorization check in SAP ABAP Platform (<\/b>3626303<\/u><\/b><\/a>)<\/b>: A regression caused by an API change in the SAP ABAP platform re-introduces a previously fixed authorization weakness. The session manager can be opened in individual transaction mode, even from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resulting in a high impact on integrity and low impact on confidentiality. It does not affect availability. CVSS v3 Base Score <\/b>7.1<\/b><\/span>\/10 [<\/b>CVE-2026-89120<\/u><\/b><\/a>]<\/b>.<\/div>\n<\/li>\n<\/ul>\n<\/p>\n
Reference Links<\/strong><\/p>\n
References from SAP and Onapsis:<\/div>\n<\/div>\n - \n
- \n