Threat reportVulnerabilityTL-2026-3412
SAP October 2026 Patch Day: Critical Flaws in Cloud SDK for Python, NetWeaver Visual Composer and S/4HANA (CVE-2026-89111, CVE-2026-89110, CVE-2026-89107)
SAP October 2026 Patch Day (TL-2026-3412), also tracked as SAP Security Patch Day October 2026, is a critical-severity software vulnerability scored CVSS 10, first published 2026-10-13 and last reviewed 2026-10-14. It has no confirmed attribution, affects SAP SAP Cloud SDK for Python (sap-cloud-sdk), references 13 CVEs (CVE-2026-89111, CVE-2026-89110, CVE-2026-89107), maps to 12 MITRE ATT&CK techniques (T1059, T1068, T1078), and is covered by 9 detection rules and 19 indicators of compromise.
- CVSS
- 10/10Critical
- CVEs
- 13Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-3412
- Threat ID
- TL-2026-3412
- Also known as
- SAP Security Patch Day October 2026
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- manufacturing, retail, enterprise, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
- Updates
- 2026-10-14 · 3 updates · revalidated 3× · latest source
Malware and tooling in SAP October 2026 Patch Day
Malware and tooling: Python
How SAP October 2026 Patch Day works
SAP's October 13, 2026 Security Patch Day fixed multiple critical flaws, led by CVE-2026-89111 (CVSS 10.0, OAuth2 SSRF in SAP Cloud SDK for Python before 0.45.2), CVE-2026-89110 (CVSS 9.9, broken access control in NetWeaver Visual Composer VC70RUNTIME 7.50) and CVE-2026-89107 (CVSS 9.9, code injection in S/4HANA S4CORE 105-109). No active exploitation, public exploit or attribution is reported.
SAP's October 2026 Security Patch Day (October 13, 2026) delivered 16 new security notes, 2 updated notes and 4 GitHub advisories covering 22 CVEs. Four are rated critical and several more high.
CVE-2026-89111 (CVSS 10.0, CWE-918) affects the open-source SAP Cloud SDK for Python (sap-cloud-sdk) before 0.45.2, in multi-tenant SAP BTP applications. The SDK did not validate the tenant_subdomain parameter before substituting it into the OAuth2 token URL. An attacker who controls that value can redirect the token request to an attacker-controlled server and capture client credentials. The fix in 0.45.2 validates tenant_subdomain against RFC 1123 DNS label rules. For consumers that cannot upgrade immediately, the advisory suggests validating tenant_subdomain against an allowlist of registered tenant subdomains before passing it to any SDK call. The reporter is credited as SunandM. The SAP portal lists the vector as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; the GitHub advisory and NVD text show A:N, which is inconsistent with the 10.0 score, so the SAP portal vector is used here.
CVE-2026-89110 (CVSS 9.9, CWE-749, SAP Note 3797111) is a broken access control flaw in SAP NetWeaver Visual Composer (VC70RUNTIME 7.50). Insufficient authorization checks in certain portal functionality let a low-privileged, network-reachable attacker perform unauthorized operations on remote systems, with scope change and high confidentiality, integrity and availability impact.
CVE-2026-89107 (CVSS 9.9, CWE-94, SAP Note 3805589) is a code injection flaw in SAP S/4HANA Manage Substitution/Validation Rules (S4CORE 105-109). Input processed by rule definitions that use domain-specific scripting is insufficiently validated, so an authorized attacker can inject crafted code that is interpreted as executable ABAP.
CVE-2026-89108 (CVSS 9.1, SAP Note 3798788) is a missing authorization check in SAP Manufacturing Integration & Intelligence (XMII 15.4, 15.5) that requires high privileges. High-severity items include SQL injection in SAP Commerce Cloud (CVE-2026-89113, 8.8, COM_CLOUD 2211-JDK21), memory corruption in the Internet Communication Manager of NetWeaver/Web Dispatcher (CVE-2026-58249, 7.5, availability impact, SAP Note 3626303) and missing authorization in ABAP Platform KERNEL 7.93/9.16 (CVE-2026-89120, 7.1).
The bulletin reports no active exploitation, public exploit availability or attribution. The seven CVEs tracked in this record were not found in the portion of the CISA KEV catalog that could be read (first 100,000 characters of a roughly 1.78M-character feed), so the KEV check is partial. No network IOCs are published, so no BeaconBeagle correlation was possible. Defenders should prioritize patching and review authorization, rule-definition and OAuth token-request telemetry.
MITRE ATT&CK techniques used in TL-2026-3412
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1078 Valid Accounts; T1078.004 Valid Accounts: Cloud Accounts; T1190 Exploit Public-Facing Application
Persistence
Lateral Movement
T1210 Exploitation of Remote Services
Credential Access
T1212 Exploitation for Credential Access; T1528 Steal Application Access Token
Impact
T1499.004 Endpoint Denial of Service; T1565 Data Manipulation
lateral-movement
Affected products and versions in SAP October 2026 Patch Day
- SAP — SAP Cloud SDK for Python (sap-cloud-sdk)
Vulnerable versions: < 0.45.2
Fixed in: 0.45.2 - SAP — SAP NetWeaver Visual Composer
Vulnerable versions: VC70RUNTIME 7.50
Fixed in: SAP Note 3797111 - SAP — SAP S/4HANA (Manage Substitution/Validation Rules)
Vulnerable versions: S4CORE 105; S4CORE 106; S4CORE 107; S4CORE 108; S4CORE 109
Fixed in: SAP Note 3805589 - SAP — SAP Manufacturing Integration and Intelligence
Vulnerable versions: XMII 15.4; XMII 15.5
Fixed in: SAP Note 3798788 - SAP — SAP Commerce Cloud
Vulnerable versions: COM_CLOUD 2211-JDK21
Fixed in: SAP Note 3765424 - SAP — SAP NetWeaver / Web Dispatcher (Internet Communication Manager)
Vulnerable versions: Multiple KERNEL, WEBDISP, HDB versions
Fixed in: SAP Note 3626303 - SAP — SAP ABAP Platform
Vulnerable versions: KERNEL 7.93; KERNEL 9.16
Fixed in: See SAP Security Patch Day October 2026
Remediation for SAP October 2026 Patch Day
Patches
- SAP Cloud SDK for Python 0.45.2 (GHSA-4mv3-jxxm-9cx2)
- SAP Note 3797111 (CVE-2026-89110)
- SAP Note 3805589 (CVE-2026-89107)
- SAP Note 3798788 (CVE-2026-89108)
- SAP Note 3765424 (CVE-2026-89113)
- SAP Note 3626303 (CVE-2026-58249)
Immediate actions
- Upgrade sap-cloud-sdk (SAP Cloud SDK for Python) to 0.45.2 or later
- Apply SAP Notes 3797111 (Visual Composer), 3805589 (S/4HANA Substitution/Validation Rules) and 3798788 (XMII)
- Inventory SAP landscapes for NetWeaver Visual Composer VC70RUNTIME 7.50 and S4CORE 105-109
Workarounds
- Validate tenant_subdomain against an allowlist of registered tenant subdomains before passing it to any Cloud SDK for Python call
Longer-term hardening
- Review and minimize low-privilege roles with access to Visual Composer and substitution/validation rule maintenance
- Monitor changes to substitution/validation rule definitions and SAP BTP OAuth token requests
CVEs associated with SAP October 2026 Patch Day
- CVE-2026-89111
- CVE-2026-89110
- CVE-2026-89107
- CVE-2026-89108
- CVE-2026-89113
- CVE-2026-58249
- CVE-2026-89120
CVE-2026-89116CVE-2026-24316CVE-2026-89112CVE-2026-89105CVE-2026-89121CVE-2026-58242
Weaknesses (CWE) in SAP October 2026 Patch Day
Timeline of SAP October 2026 Patch Day
- Partial CISA KEV check (first 100,000 characters of the feed): none of the seven tracked CVEs listed; no exploitation evidence in sources.
- GBHackers reports the SAP patches; the bulletin states no active exploitation, public exploit availability or attribution.
- SAP Notes 3797111 (Visual Composer), 3805589 (S/4HANA Substitution/Validation Rules) and 3798788 (XMII) made available to customers.
- NVD publishes CVE-2026-89111 (CVSS 10.0, CWE-918), CVE-2026-89110 (CVSS 9.9, CWE-749) and CVE-2026-89107 (CVSS 9.9, CWE-94).
- GitHub advisory GHSA-4mv3-jxxm-9cx2 published for CVE-2026-89111; sap-cloud-sdk 0.45.2 validates tenant_subdomain against RFC 1123 DNS label rules (reporter credited: SunandM).
- SAP releases October 2026 Security Patch Day: 16 new security notes, 2 updates and 4 GitHub advisories covering 22 CVEs, including four critical flaws.
- The Cyber Express reports the patch day and CVE-2026-89111; no exploitation, PoC or attribution reported.
- SecurityWeek reports the four critical SAP fixes (CVE-2026-89111, -89110, -89107, -89108) and states no in-the-wild exploitation was reported; Onapsis is credited in the coverage.
Update history for TL-2026-3412
- 2026-10-14 — SAP October 2026 Patch Day: CVE-2026-89111 (CVSS 10.0) OAuth2 SSRF in SAP Cloud SDK for Python plus three other critical flaws (CVE-2026-89110, CVE-2026-89107, CVE-2026-89108): What changed No field changes. Severity (CRITICAL, CVSS 10.0), exploitability (NONE) and status (PATCHED) are unchanged; the newer report also states no exploitation, PoC or attribution. New indicators (0) None. The upstream repository URL
- 2026-10-14 — SAP October 2026 Patch Day: Critical Cloud SDK for Python, NetWeaver Visual Composer, S/4HANA and Manufacturing Integration and Intelligence Vulnerabilities (CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, CVE-2026-89108): What changed No severity, exploitability, status or CVSS change. Existing values (CRITICAL, NONE, PATCHED, 10.0) stand; the newer report also reports no exploitation, PoC or attribution. New indicators (6) Four behavioral observables (redir
- 2026-10-13 — SAP October 2026 Patch Day: Critical Code Injection, SSRF and Access Control Flaws (CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, CVE-2026-89108): What changed No field escalation. Severity (CRITICAL), exploitability (NONE) and status (PATCHED) are unchanged; the newer report's THEORETICAL/MONITORING values are not an escalation and are ignored. New indicators (4) 3 additional affecte
Sources cited for SAP October 2026 Patch Day
- SAP Support Portal - Security Notes October 2026
- SAP Patches Critical NetWeaver and S/4HANA Security Flaws Affecting Enterprise Systems
- GHSA-4mv3-jxxm-9cx2: OAuth2 SSRF in SAP Cloud SDK for Python
- NVD - CVE-2026-89111
- NVD - CVE-2026-89110
- NVD - CVE-2026-89107
- SAP Note 3797111 - CVE-2026-89110 Visual Composer
- SAP Note 3805589 - CVE-2026-89107 S/4HANA
- SAP Security Patch Day landing page
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-3412
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3412 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.