cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

SAP Patches Critical NetWeaver, S/4HANA and Other Vulnerabilities

· Original article ↗

Summary

SAP released 22 new and updated security notes, including four critical vulnerabilities affecting Cloud SDK for Python, NetWeaver Visual Composer, S/4HANA and Manufacturing Integration and Intelligence. No exploitation in the wild was reported.

Key points

  • CVE-2026-89111 is a critical OAuth2 SSRF flaw in Cloud SDK for Python that could expose client credentials in affected multi-tenant BTP applications.
  • CVE-2026-89110 is a critical broken access control vulnerability in NetWeaver Visual Composer that could let a low-privileged attacker invoke internal operations on a preconfigured remote system.
  • CVE-2026-89107 is a critical S/4HANA code injection flaw that could let authenticated attackers execute arbitrary ABAP code and take over a vulnerable system.
  • CVE-2026-89108 is a critical authorization-check flaw in Manufacturing Integration and Intelligence that could let an XMII administrator create an administrator account on the underlying Java application server.
  • SAP also patched high-severity flaws in Commerce Cloud, NetWeaver and ABAP Platform involving SQL injection, process crashes and restriction bypasses.
  • SAP did not report exploitation of the newly fixed flaws in the wild and advised users to update their applications promptly.

Article Details

Vulnerability Types
  • OAuth2 server-side request forgery (SSRF)
  • Broken access control
  • Code injection
  • Missing authorization check
  • SQL injection
  • Process crash
  • Restriction bypass
Severity
Four critical vulnerabilities: CVSS 10.0, 9.9, 9.9, and 9.1. Additional high-severity flaws were also resolved.
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-89107The third critical-severity vulnerability resolved on SAP’s October 2026 Security Patch Day is CVE-2026-89107 (CVSS score of 9.9/10), a code injection issue in S/4HANA that could allow authenticated attackers to executeCVE-2026-89108The fourth critical bug is CVE-2026-89108 (CVSS score of 9.1/10), a missing authorization check in Manufacturing Integration and Intelligence that could allow an attacker with XMII Admin privileges to create anCVE-2026-89110Next in line is CVE-2026-89110 (CVSS score of 9.9/10), a broken access control in certain portal functionality of NetWeaver Visual Composer.CVE-2026-89111At the top of the list is CVE-2026-89111 (CVSS score of 10/10), an OAuth2 SSRF vulnerability in Cloud SDK for Python that impacts multi-tenant BTP applications.

Vendors

SAPEnterprise software maker SAP on Tuesday announced the release of 22 new and updated security notes, including four that address critical-severity vulnerabilities.

Products

ABAP PlatformOn Tuesday, SAP also resolved high-severity flaws in Commerce Cloud, NetWeaver, and ABAP Platform that could allow attackers to inject arbitrary SQL commands, trigger a process crash, and bypass restrictions.Commerce CloudOn Tuesday, SAP also resolved high-severity flaws in Commerce Cloud, NetWeaver, and ABAP Platform that could allow attackers to inject arbitrary SQL commands, trigger a process crash, and bypass restrictions.Fiori ApplicationsThe security defect exists because the rule definition process fails to properly validate input, allowing attackers holding a specific business role in the Fiori Applications to submit crafted input.S/4HANAOctober 2026 Security Patch Day is CVE-2026-89107 (CVSS score of 9.9/10), a code injection issue in S/4HANA that could allow authenticated attackers to execute arbitrary ABAP code on the system.SAP Business Technology Platform (BTP)At the top of the list is CVE-2026-89111 (CVSS score of 10/10), an OAuth2 SSRF vulnerability in Cloud SDK for Python that impacts multi-tenant BTP applications.SAP Cloud SDK for PythonAt the top of the list is CVE-2026-89111 (CVSS score of 10/10), an OAuth2 SSRF vulnerability in Cloud SDK for Python that impacts multi-tenant BTP applications.SAP Manufacturing Integration and Intelligencecritical bug is CVE-2026-89108 (CVSS score of 9.1/10), a missing authorization check in Manufacturing Integration and Intelligence that could allow an attacker with XMII Admin privileges to create an administratorSAP NetWeaverNext in line is CVE-2026-89110 (CVSS score of 9.9/10), a broken access control in certain portal functionality of NetWeaver Visual Composer.SAP NetWeaver Visual ComposerNext in line is CVE-2026-89110 (CVSS score of 9.9/10), a broken access control in certain portal functionality of NetWeaver Visual Composer.

Related Articles