SAP, a leading provider of enterprise software, announced the release of 22 new and updated security notes on Tuesday. Among these updates, four critical vulnerabilities have been addressed, including the highly severe CVE-2026-89111 with a CVSS score of 10 out of 10.
Details on Critical Vulnerabilities
The most significant vulnerability, CVE-2026-89111, is an OAuth2 Server-Side Request Forgery (SSRF) found in the Cloud SDK for Python. This issue affects multi-tenant BTP applications and could enable attackers to redirect OAuth2 token requests to a server under their control, potentially exposing client credentials.
Another critical flaw, identified as CVE-2026-89110, involves broken access control in the NetWeaver Visual Composer portal functionality. According to security firm Onapsis, this vulnerability allows a low-privileged attacker to execute internal operations on a remote system, which could result in full system compromise.
Additional Severe Vulnerabilities
SAP’s October 2026 Security Patch Day also addressed CVE-2026-89107, a code injection vulnerability in S/4HANA. This flaw permits authenticated attackers to run arbitrary ABAP code, potentially allowing them to take control of affected systems. The problem arises from inadequate input validation during the rule definition process.
The fourth critical vulnerability, CVE-2026-89108, involves a missing authorization check in Manufacturing Integration and Intelligence. Attackers with XMII Admin privileges could exploit this flaw to create an administrator account on the Java application server, leading to a complete system compromise.
Other Security Enhancements
In addition to these critical vulnerabilities, SAP has resolved several high-severity issues across various platforms, including Commerce Cloud, NetWeaver, and the ABAP Platform. These vulnerabilities could allow attackers to inject SQL commands, cause process crashes, and bypass existing security restrictions.
SAP has not reported any instances of these newly resolved vulnerabilities being actively exploited. Users are strongly recommended to update their systems promptly to ensure protection against potential threats.
For further information on recent security updates, users can reference related articles discussing vulnerabilities in other software products such as Ivanti, Adobe, and SonicWall.
