Skip to content

Back to the catalog

Dark Web Intelligence (@DailyDarkWeb) on X
x.comadvisory

Dark Web Intelligence (@DailyDarkWeb) on X

Summary of SAP's October 13, 2026 Security Patch Day (16 new notes, 4 GitHub advisories). It leads with CVE-2026-89111, a CVSS 10.0 OAuth2 SSRF in SAP Cloud SDK for Python before 0.45.2, where an attacker-controlled tenant_subdomain redirects token requests and exfiltrates client credentials. It also lists three other critical flaws: broken access control in NetWeaver Visual Composer, code injection in S/4HANA substitution/validation rules, and a missing authorization check in the Manufacturing Integration and Intelligence (XMII) Configuration Service. It notes that none are in CISA KEV and SAP reports no in-the-wild exploitation.

TL;DR SAP October 2026 Patch Day: CVSS 10.0 OAuth2 SSRF in Cloud SDK for Python (fixed in 0.45.2) plus three other critical flaws, none known exploited.
Open original ↗
Document

What it is

SAP's October 13, 2026 Security Patch Day digest, relayed by a third-party X account (@DailyDarkWeb) rather than SAP. It covers 16 new notes, 4 GitHub advisories and 2 updates to earlier notes. The page gives per-item CVE ids, CVSS scores and affected versions, which the catalog summary mostly omits.

Preconditions / Affected

CVECVSSProductAffected
CVE-2026-8911110.0SAP Cloud SDK for Python (OAuth2 SSRF)< 0.45.2
CVE-2026-891109.9NetWeaver Visual Composer (broken access control)VC70RUNTIME 7.50
CVE-2026-891079.9S/4HANA Manage Substitution/Validation Rules (code injection)S4CORE 105–109
CVE-2026-891089.1Manufacturing Integration and Intelligence Configuration Service (missing authorization check)XMII 15.4 / 15.5

The page also lists two High items:

  • CVE-2026-89113: SQL injection in Commerce Cloud, CVSS 8.8.
  • CVE-2026-58249: memory corruption in NetWeaver / Web Dispatcher ICM, CVSS 7.5.

For CVE-2026-89111, the flaw is that an attacker-controlled tenant_subdomain can redirect OAuth2 token requests and exfiltrate client credentials. Any app that passes untrusted input into that parameter is the exposure. The page does not describe the exact call path.

What to do

  • Upgrade SAP Cloud SDK for Python to 0.45.2 or later.
  • If you cannot upgrade immediately, the page says an allowlist workaround exists, but it does not describe it. Check the GHSA for CVE-2026-89111 (linked from the post) for the actual steps.
  • Check your landscape for the other three affected components and versions in the table, and apply the corresponding SAP notes. The post links only to the SAP support portal, and the URL is truncated.
  • The post's own advice is to prioritize the four Critical / HotNews items.

Caveats

  • The post is secondary reporting. Confirm details against the SAP Patch Day page and the GHSA before acting.
  • Not in CISA KEV as of catalog 2026.10.08, so that check is about a week old. SAP reports no in-the-wild exploitation. This is current status, not a guarantee.
  • The post gives no exploit details, detection guidance or SAP note numbers.
  • The allowlist workaround is unspecified on the page.

CVEs named here

Technologies named here

Techniques named here

Related in AppSec