Summary
- SAP released 16 new notes and four GitHub advisories on 13 October.
- A Cloud SDK for Python SSRF vulnerability carries a CVSS 10.0 score.
- Critical NetWeaver, S/4HANA and manufacturing software flaws require targeted review.
SAP has released a substantial set of security corrections for its enterprise software portfolio, including a maximum-severity vulnerability in the SAP Cloud SDK for Python and critical flaws affecting NetWeaver Visual Composer and S/4HANA. The company’s 13 October Patch Day comprised 16 new security notes, four GitHub security advisories and two updates to previously published notes.
The highest-rated issue, CVE-2026-89111, is an OAuth2 server-side request forgery vulnerability in versions of SAP Cloud SDK for Python before 0.45.2. SAP assigns it a CVSS score of 10.0. Server-side request forgery can allow a vulnerable application to send requests to destinations chosen by an attacker, potentially crossing boundaries between the application and systems it can reach. The actual exposure will depend on deployment configuration, network controls and the application’s use of the affected library.
Other entries affect business applications with potentially extensive permissions and integrations. CVE-2026-89110 is a broken access-control vulnerability in SAP NetWeaver Visual Composer, rated 9.9, while CVE-2026-89107 is a code injection vulnerability in the S/4HANA Manage Substitution/Validation Rules component, also rated 9.9. SAP also lists CVE-2026-89108, a missing authorisation check in Manufacturing Integration and Intelligence’s configuration service, with a score of 9.1.
These weaknesses involve different products and technical mechanisms, so a headline severity ranking does not substitute for checking each organisation’s installed components. Cloud SDK libraries can be introduced as application dependencies; a NetWeaver system may serve legacy integrations; and S/4HANA functionality may be available only to particular business roles. Those differences govern whether a security note applies and what testing is necessary before a fix can be introduced.
ERP and manufacturing systems also have different operational tolerances from ordinary office applications. Applying a correction to a heavily customised environment may require compatibility testing with connected systems, while leaving an affected service unchanged preserves the exposure described in the advisory. SAP’s notes are therefore relevant to application owners, infrastructure operators and teams managing supplier-supported services rather than to one central patching function alone.
The manufacturing advisory illustrates the wider reach of enterprise application security. Configuration services often connect information flows between production data, reporting and business platforms. Unauthorised changes within such services could have consequences for data integrity and downstream processes, although SAP’s public listing does not establish that exploitation has occurred or that any customer has been compromised.
The individual advisories address weaknesses at different trust boundaries. A server-side request forgery issue can permit a server to contact services that an external client cannot reach directly, while a missing authorisation check allows actions without the intended permission. Code injection can create a separate route to executing unintended instructions. Each vulnerability requires a different remediation path because the products, permissions and attack conditions differ. The advisory also includes affected component versions that do not necessarily align neatly with an organisation’s marketed product names.
Custom-developed applications using the Python SDK could be missed in an inventory focused solely on SAP’s large application suites, while a heavily customised ERP landscape may depend on installations whose patch levels are documented in separate change records. The vendor’s support notes provide the detailed remediation paths, but organisations still need an accurate map between technical components and business services. Where a system connects finance, manufacturing or order processing, a maintenance interruption requires coordination with the service owner. SAP has not identified these patch notes as evidence that customers were breached; the individual advisories describe remedial releases.
SAP recommends using its support portal to obtain the applicable notes and updates. Its October table provides product versions, CVE identifiers and severity scores, but the published list is not evidence of active attacks. Organisations will need to reconcile those identifiers against their deployed landscapes and SAP’s individual remediation instructions. The two revised earlier notes also warrant attention where a previously completed patch review may have relied on the older advice.
