SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

What it is

SAP's October 2026 Security Patch Day fixed four critical flaws. The page adds the privilege each one requires, which the catalog summary mostly leaves out. That is the main input for patch ordering.

Preconditions / Affected

• CVE-2026-89111 (CVSS 10): affects multi-tenant BTP applications built on SAP Cloud SDK for Python. The attacker only needs to control the tenant_subdomain parameter. The page states no authentication requirement. The attacker redirects OAuth2 token requests to a server they control, and the client credentials are exfiltrated. SAP published the details in a GitHub advisory.
• CVE-2026-89110 (9.9): the attacker must be authenticated and hold a specific business role in the Fiori Applications. The rule definition process does not validate input, so crafted input leads to arbitrary ABAP code execution. Onapsis says this can mean system takeover.
• CVE-2026-89107 (9.9): this is S/4HANA Visual Composer code injection. Per Onapsis, a low-privileged attacker can invoke internal operations on a preconfigured remote system and fully compromise it. The target is the remote system, not necessarily the S/4HANA host.
• CVE-2026-89108 (9.1): the attacker must already hold XMII Admin privileges in Manufacturing Integration and Intelligence. The missing authorization check lets them create an administrator account on the underlying Java application server. This is privilege escalation from an application admin to a server admin, not an unauthenticated entry point.

What to do

• Apply the October 2026 SAP security notes. The page says to update as soon as possible, and it gives no workarounds, fixed versions or note numbers.
• Treat CVE-2026-89111 first if you run multi-tenant BTP apps on the Python Cloud SDK. It has the lowest stated precondition, and what leaks is client credentials.
• For CVE-2026-89110 and CVE-2026-89107, review who holds the Fiori business role and who has low-privilege access. That population defines your exposure until patching is done.
• The same patch day also fixed high-severity flaws in Commerce Cloud, NetWeaver and ABAP Platform. They allow SQL injection, a process crash and restriction bypass. Include them in the same patch window.

Caveats

• SAP does not mention exploitation in the wild for any of these fixes.
• The page does not name the business role needed for CVE-2026-89110, and it gives no affected or fixed version ranges.