SAP October 2026 patches: CVSS 10 OAuth2 SSRF in Cloud SDK

On Tuesday 13 October 2026 SAP released its monthly Security Patch Day. The most serious issue is CVE-2026-89111, a Server-Side Request Forgery (SSRF) vulnerability in the OAuth2 token handling of SAP Cloud SDK for Python, rated CVSS 10, the maximum. Alongside it, SAP fixed three more critical vulnerabilities, in NetWeaver Visual Composer, S/4HANA and Manufacturing Integration and Intelligence (MII).

The sources disagree on the overall count: SecurityWeek reports 22 new or updated security notes, four of them critical, while BleepingComputer reports 20 vulnerabilities fixed. The difference may come from the fact that a note does not always map to a single vulnerability. On the same day the Canadian Centre for Cyber Security published advisory AV26-1030, listing the affected products and versions.

What happened

According to SecurityWeek, which quotes SAP’s advisory on GitHub, CVE-2026-89111 affects multi-tenant applications on SAP Business Technology Platform (BTP) built with Cloud SDK for Python. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to a server under their control: the application then hands over its own client credentials (client ID and secret). With those credentials the attacker can request tokens on behalf of the application.

According to SecurityWeek, SAP does not report any exploitation in the wild for the vulnerabilities fixed in this cycle.

Technical details

The critical vulnerabilities, with the data reported by SecurityWeek (which cites security firm Onapsis for three of them) and the versions listed by the Canadian Centre:

• CVE-2026-89111 (CVSS 10), OAuth2 SSRF in Cloud SDK for Python. It affects multi-tenant BTP applications; the Canadian Centre lists SAP Cloud SDK versions prior to 0.45.2 as vulnerable.
• CVE-2026-89110 (CVSS 9.9), broken access control in certain portal functionality of NetWeaver Visual Composer (VC70RUNTIME 7.50). According to Onapsis, a low-privileged attacker can invoke internal operations on a preconfigured remote system and fully compromise it.
• CVE-2026-89107 (CVSS 9.9), code injection in S/4HANA, in the Manage Substitution/Validation Rules function (S4CORE 105, 106, 107, 108 and 109). The rule definition process does not validate input: an authenticated user holding a specific business role in the Fiori applications can submit crafted input and execute arbitrary ABAP code, up to taking over the system.
• CVE-2026-89108 (CVSS 9.1), missing authorization check in Manufacturing Integration and Intelligence (Configuration Service, versions 15.5 and XMII 15.4). A user with XMII Admin privileges can create an administrator account on the underlying Java application server and compromise the system.

Among the high-severity vulnerabilities, SecurityWeek mentions flaws in Commerce Cloud, NetWeaver and ABAP Platform that allow SQL injection, process crashes and restriction bypass, without giving the CVE identifiers. The Canadian Centre also lists among the affected products:

• SAP Commerce Cloud (OOTB Code), version COM_CLOUD 2211-JDK21;
• SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager), versions HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, CONTSERV 7.53, 7.54, KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19 and 9.20.

In MITRE ATT&CK terms, exploiting externally reachable applications generally maps to T1190 (Exploit Public-Facing Application), using stolen client credentials to T1078.004 (Valid Accounts: Cloud Accounts) and creating an administrator on MII to T1136 (Create Account). The available sources do not provide indicators of compromise.

Impact for European and Italian companies

SAP is the business backbone of many companies in manufacturing, retail and healthcare. Three of the four critical vulnerabilities require initial access, even with few privileges: the main risk therefore comes from compromised internal accounts or users with broader roles than necessary. CVE-2026-89111 is different: it affects the code of applications built on BTP, and therefore anyone who develops multi-tenant extensions or services, including through external suppliers.

For entities in scope of NIS2 (in Italy, Legislative Decree 138/2024), vulnerability management and supply chain security are part of the required measures: it is worth asking suppliers that build BTP applications whether they use Cloud SDK for Python and when they will update it. Any theft of client credentials should be assessed for notification to the national CSIRT, in Italy the CSIRT Italia of ACN.

What to do now

1. Look for Cloud SDK for Python in the dependencies of your BTP applications, including those developed by third parties, and update it to 0.45.2 or later, checking the correct version in SAP’s advisory. Then rebuild and redeploy the applications.
2. Consider rotating the secrets of the OAuth2 clients used by exposed multi-tenant applications, if you cannot rule out that they were stolen before the update.
3. Check the logs of the applications and outbound traffic: token requests to hosts other than the expected authentication service are a signal worth investigating.
4. Apply the October notes to NetWeaver Visual Composer, S/4HANA (S4CORE 105–109) and MII, then to Commerce Cloud, the NetWeaver kernel and Web Dispatcher, starting with internet-facing systems.
5. Reduce privileges until patches are in place: review who holds the role to define substitution and validation rules in S/4HANA and who has XMII Admin privileges on MII.
6. Review the administrator accounts of the Java application servers hosting MII, looking for recently created, unexpected users.

How ARXDOME helps

ARX Shield lists open vulnerabilities by machine and by package on monitored machines, and shows how old they are: it helps you track the systems still to be updated. ARX Expose shows which services your company exposes on the internet and which products are recognised on them, useful to find out whether a Web Dispatcher or an SAP portal is reachable from outside. ARX Sentry, in the SOC pages dedicated to identities, shows privileged access and account changes.

Last updated: 14 October 2026