SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

SAP's October 2026 Security Patch Day delivered 22 notes, four addressing critical-severity flaws across its product line. The most severe, CVE-2026-89111 (CVSS 10), is an OAuth2 SSRF bug in Cloud SDK for Python affecting multi-tenant BTP apps, letting an attacker manipulate the tenant_subdomain parameter to redirect token requests and steal client credentials. CVE-2026-89110 (CVSS 9.9) is a broken access control flaw in NetWeaver Visual Composer that lets a low-privileged user trigger internal operations on a connected remote system, while CVE-2026-89107 (CVSS 9.9) is a code injection issue in S/4HANA allowing authenticated users with a specific Fiori business role to run arbitrary ABAP code and seize the system. CVE-2026-89108 (CVSS 9.1) is a missing authorization check in Manufacturing Integration and Intelligence that lets an XMII Admin create a rogue administrator account on the Java application server. SAP also patched high-severity SQL injection, crash, and bypass issues in Commerce Cloud, NetWeaver, and ABAP Platform; no active exploitation has been reported, but customers should apply the fixes promptly.