SAP Issues Critical Security Patches for NetWeaver and S/4HANA Environments

Enterprise software giant SAP has released its October security updates, delivering 22 new and updated security notes to address vulnerabilities across its core product lineup. Among the batch are four critical-severity flaws capable of granting malicious actors extensive system access if left unaddressed. Security researchers and application security firms have highlighted the potential risks associated with these vulnerabilities, urging organizations to apply the newly issued patches immediately to maintain infrastructure integrity.

Critical Flaws Target Core Enterprise Components

The most severe vulnerability addressed in this patch cycle is tracked as CVE-2026-89111, carrying a maximum CVSS score of 10 out of 10. This OAuth2 server-side request forgery flaw affects the Cloud SDK for Python and impacts multi-tenant business technology platform applications. According to advisory documentation, malicious actors capable of manipulating specific parameters can redirect token requests to external, unauthorized servers, potentially leading to the exfiltration of sensitive client credentials.

Another high-impact issue is CVE-2026-89110, featuring a CVSS score of 9.9. Identified as a broken access control vulnerability within specific portal features of NetWeaver Visual Composer, enterprise security specialists noted that low-privileged users could invoke internal operations on preconfigured remote systems, resulting in complete system compromise.

Code Injection and Authorization Risks

Additional critical vulnerabilities demand immediate attention from enterprise administrators:

• CVE-2026-89107 presents a code injection risk in S/4HANA with a 9.9 CVSS score, allowing authenticated users with specific business roles in Fiori Applications to execute arbitrary code.
• CVE-2026-89108 involves a missing authorization check in Manufacturing Integration and Intelligence, granting high-privileged users the ability to create rogue administrator accounts.

In addition to these critical items, SAP resolved multiple high-severity vulnerabilities impacting Commerce Cloud, NetWeaver, and the ABAP Platform. These flaws included potential SQL injection vectors, process crash triggers, and restriction bypasses. At the time of the advisory release, the vendor confirmed that there were no indications of these specific security defects being actively exploited in live production environments. System administrators and security operations teams are strongly advised to deploy the updated packages across all affected environments as part of routine vulnerability management protocols.