SAP security week 42 2026: four critical vulnerabilities lead 20 CVEs

The release at a glance

SAP's security release for 12–18 October 2026 covers 20 CVEs across SAP Cloud, S/4HANA, NetWeaver, Manufacturing Integration and Intelligence, Commerce Cloud, ABAP Platform, SAPUI5 and several open-source components. Four are rated critical, three high, twelve medium and one low. None of the entries appears in CISA's KEV catalogue. The CVEs detailed in this roundup did not list fixed versions at the time of writing. SAP's security notes can be found via the SAP Security Patch Day page.

What matters most

SAP Cloud SDK for Python — CVE-2026-89111. An OAuth2 SSRF flaw rated CVSS 10. In multi-tenant BTP applications, an attacker who controls tenant_subdomain can redirect OAuth2 token requests to an attacker-controlled server and exfiltrate client credentials. It is reachable over the network without credentials and has a dedicated advisory page on this site. A GitHub advisory is available for this flaw.

SAP S/4HANA — CVE-2026-89107. Manage Substitution/Validation Rules does not sufficiently validate input, allowing an authenticated attacker with specific business privileges to execute arbitrary ABAP code. CVSS 9.9. Affected versions include S4CORE 105 through 109.

SAP NetWeaver Visual Composer — CVE-2026-89110. Missing authorization checks let a low-privileged user invoke internal operations on a preconfigured remote system, potentially leading to full compromise of that remote system. CVSS 9.9. Affected version VC70RUNTIME 7.50.

SAP Manufacturing Integration and Intelligence — CVE-2026-89108. Missing authorization in the Configuration Service lets an attacker with MII administrator privileges provision an account with elevated privileges on the underlying Java application server. CVSS 9.1. Affected versions XMII 15.4 and 15.5.

SAP Commerce Cloud — CVE-2026-89113. SQL injection in out-of-the-box code lets an authenticated user read, modify or delete database data. CVSS 8.8. Affected version COM_CLOUD 2211-JDK21.

SAP NetWeaver and SAP Web Dispatcher — CVE-2026-58249. Memory corruption in the Internet Communication Manager can be triggered by an unauthenticated attacker with a specially crafted request, crashing the process and impacting availability. CVSS 7.5. Affected versions include HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16 and XS_ADVANCED_RUNTIME 1.00.

SAP ABAP Platform — CVE-2026-89120. A regression from an API change reintroduces a missing authorization check in the session manager, allowing a low-privileged attacker to bypass restrictions. CVSS 7.1. Affected versions KERNEL 7.93 and 9.16.

CLA-Assistant — CVE-2026-89112. Broken access control in the admin API can expose CLA signature records, including contributor information, to an authenticated user who is not authorised for the target organisation. CVSS 6.5. Affected up to and including v2.13.1. A GitHub advisory is available for this flaw.

Patch in this order

Because no fixed versions are listed for the CVEs discussed here, treat this as a prioritisation order for monitoring and deployment when SAP publishes fixes.

1. Put CVE-2026-89111 first if you run multi-tenant BTP applications using SAP Cloud SDK for Python. It is a pre-authentication, network-reachable SSRF with CVSS 10 and can expose client credentials. Review the GitHub advisory and limit exposure of affected applications until a fix is released.
2. Prioritise CVE-2026-58249 for any internet-facing SAP NetWeaver or SAP Web Dispatcher. The unauthenticated denial-of-service can crash the ICM service. No fixed version was listed.
3. Schedule the critical authenticated flaws: CVE-2026-89107 in S/4HANA, CVE-2026-89110 in Visual Composer and CVE-2026-89108 in MII. They require privileges but can lead to full system compromise.
4. Address CVE-2026-89113 in Commerce Cloud and CVE-2026-89120 in ABAP Platform; both are authenticated high-severity issues affecting data integrity and confidentiality.
5. Review CLA-Assistant deployments for CVE-2026-89112 and restrict admin API access where possible until patched.
6. Then clear the remaining medium and low CVEs across SAP NetWeaver Enterprise Portal, SAPUI5, yeoman-ui, SAP GUI for HTML, Linear Asset Management, SAP HANA, cloud-security-services-integration-library and SAP Cloud Connector according to your usual SAP patch cycle.

Beyond the patch

Releases like this become more manageable when they are handled through a regular SAP-specific patch cadence and exposure review rather than as one-off emergencies. Our SAP HANA Security & Cloud Migration practice can help prioritise and apply updates across an SAP estate consistently, while Virtual CISO Services can identify which internet-facing issues, such as the SAP Cloud SDK SSRF or the Web Dispatcher denial-of-service, are actually reachable in your environment.