Patching

SAP released its October security fixes on Tuesday, October 13. Four of them are rated critical: a CVSS 10.0 server-side request forgery in SAP Cloud SDK for Python, a 9.9 code injection in S/4HANA, a 9.9 access control flaw in NetWeaver Visual Composer and a 9.1 missing authorization check in SAP Manufacturing Integration and Intelligence (MII). If you run S/4HANA on S4CORE 105 to 109, a Java portal with Visual Composer, MII 15.4 or 15.5, or Python apps on SAP Business Technology Platform (BTP), at least one of them applies to you.

The counts differ by source. SAP's bulletin lists 16 new security notes, four GitHub security advisories and two updates to earlier notes, which is the 22 that some outlets report. Onapsis and Pathlock count 21, with Pathlock splitting them into three Critical, four High, thirteen Medium and one Low; the gap is mostly whether the Python SDK advisory is counted with the notes. No source reports exploitation or a public proof of concept for any of the four yet.

How the four flaws work

CVE-2026-89111, SAP Cloud SDK for Python, CVSS 10.0. Multi-tenant BTP applications look up which customer (tenant) a request belongs to and then fetch an OAuth 2.0 access token for that tenant. The SDK builds the token endpoint address from the tenant_subdomain value without validating it. An attacker who controls that value can point the token request at a server they run, and the request carries the application's client credentials. That is server-side request forgery (SSRF): the application makes a request on the attacker's behalf, here leaking the secret that lets the attacker ask for tokens as the app. It needs no login and no user interaction. Versions before 0.45.2 are affected.

CVE-2026-89107, S/4HANA, note 3805589, CVSS 9.9. Substitution and validation rules let business users define checks and field replacements that run when documents are posted. The Manage Substitution/Validation Rules function does not properly check rule input, so crafted input ends up executed as ABAP code, SAP's application language. Anyone who can run arbitrary ABAP on the application server can read and change any data the system holds. The attacker needs a business role for one of the Fiori rule-management apps, so the exposure is set by how widely you have handed those roles out.

CVE-2026-89110, NetWeaver Visual Composer, note 3797111, CVSS 9.9. Visual Composer is a model-driven tool for building portal applications that call backend systems. Some of its portal functions skip authorization checks, so a low-privileged portal user can invoke internal operations on a remote system that the portal already has a connection to. The CVSS scope is "changed": the damage lands on that backend, and how bad it is depends on the rights of the connection's service user. The affected component is VC70RUNTIME 7.50.

CVE-2026-89108, MII, note 3798788, CVSS 9.1. The Configuration Service in MII does not enforce authorization boundaries on some administrative functions. An attacker who already has MII administrator rights can send a crafted request that creates an account with elevated rights on the underlying NetWeaver Java application server, which gives them control of that server and not only the MII application. Pathlock, Strix and VulDB list XMII 15.4 and 15.5 as affected; the CVE record lists only 15.5. Check the note for your release.

The High rated ICM flaw

Note 3765424 fixes CVE-2026-58249 (CVSS 7.5) in the Internet Communication Manager (ICM), the component that handles HTTP for ABAP systems, and in SAP Web Dispatcher. A crafted request from an unauthenticated attacker triggers a memory-handling error that crashes the process. It is a denial of service, with no impact on data. Only installations with HTTP/2 enabled are affected, but SAP enables HTTP/2 by default from kernel 7.73, so most current landscapes qualify. NetWeaver AS Java is not affected. SecurityBridge points out that the note also covers Content Server and HANA XS deployments, and that backend systems reachable directly need fixing as well as the Web Dispatcher in front.

What attackers are doing

Nothing yet, as far as the public sources show. None of the four critical CVEs is in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no exploit code has been published.

Visual Composer is the one to treat with most urgency anyway. In April 2025 a missing authorization check in its metadata uploader, CVE-2025-31324 (CVSS 10.0), was exploited as a zero-day to drop web shells on internet-facing NetWeaver Java systems, and CISA later flagged it as used in ransomware campaigns. Attackers already know where Visual Composer lives and how to reach it. The new flaw needs a portal login, but on many portals that is any employee account.

What to do

1. For Python apps on BTP, search your requirements and lock files for SAP Cloud SDK for Python and move every multi-tenant app to 0.45.2 or later. Redeploy, then rotate the OAuth client secret of each affected app's service binding, because you cannot prove it was never sent elsewhere.
2. Implement note 3805589 on S4CORE 105 to 109. Sources disagree on whether SAP offers a workaround (SecurityBridge says one exists, others list none), so read the note. Until it is in, use transaction SUIM to list who holds the rule-management business roles and remove anyone who does not maintain rules.
3. Apply note 3797111 to VC70RUNTIME 7.50. If you do not use Visual Composer, disable it. RedRays reports that SAP documents a Secure Mode setting with a restart of the Visual Composer component as an interim measure; we could not confirm that in a second source, so follow the note's text. Ask the owners of each backend that Visual Composer connects to what the connection's user can do, and cut those rights down.
4. For MII, apply note 3798788. SAP lists no workaround, so until the patch is in, reduce MII administrator accounts to the people who need them. Afterwards, review the user list on the Java server in NetWeaver Administrator (Identity Management) for admin accounts you did not create.
5. Apply note 3765424 to ICM and Web Dispatcher in the same cycle. If you cannot patch soon, SAP's temporary procedure is to switch HTTP/2 off; the ICM profile parameter is icm/HTTP/support_http2, and the activation and restart steps differ by product, so follow the note.

To check for earlier abuse of the SDK flaw, look in your egress proxy or BTP application logs for token requests from the app to hosts other than your own authorization server's domain. For S/4HANA, review recent changes to substitution and validation rules and who made them.

Patch day is also a roles review

Three of the four critical flaws need an account: a rule-management role, a portal login, an MII administrator. That lowers the risk a little compared with the CVSS scores, and it means your exposure is exactly as large as your role assignments. Teams that recertify SAP roles once a year and clear out unused ones carry less risk from months like this one, and they can patch in their normal window with more confidence.

If you want an outside view of what your SAP estate exposes and which roles carry real power, our attack surface management and safeguarding and hardening teams can help. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: SAP Security Patch Day, October 2026, Onapsis, RedRays, SecurityBridge, Pathlock, Cyberpress, Cyber Security News, GBHackers, BleepingComputer, CyCognito on CVE-2026-89110, Rapid7 on CVE-2025-31324.