# SAP October 2026 Patch Day: Critical Flaws in Cloud SDK for Python, NetWeaver Visual Composer and S/4HANA (CVE-2026-89111, CVE-2026-89110, CVE-2026-89107)

> SAP's October 13, 2026 Security Patch Day fixed multiple critical flaws, led by CVE-2026-89111 (CVSS 10.0, OAuth2 SSRF in SAP Cloud SDK for Python before 0.45.2), CVE-2026-89110 (CVSS 9.9, broken access control in NetWeaver Visual Composer VC70RUNTIME 7.50) and CVE-2026-89107 (CVSS 9.9, code injection in S/4HANA S4CORE 105-109). No active exploitation, public exploit or attribution is reported.

- **Published:** 2026-10-13T13:29:10Z
- **Last reviewed:** 2026-10-14T10:57:17.484Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3412
- **ID:** TL-2026-3412
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, CVE-2026-89108, CVE-2026-89113, CVE-2026-58249, CVE-2026-89120, CVE-2026-89116, CVE-2026-24316, CVE-2026-89112, CVE-2026-89105, CVE-2026-89121, CVE-2026-58242

## Description

SAP's October 2026 Security Patch Day (October 13, 2026) delivered 16 new security notes, 2 updated notes and 4 GitHub advisories covering 22 CVEs. Four are rated critical and several more high.

CVE-2026-89111 (CVSS 10.0, CWE-918) affects the open-source SAP Cloud SDK for Python (sap-cloud-sdk) before 0.45.2, in multi-tenant SAP BTP applications. The SDK did not validate the tenant_subdomain parameter before substituting it into the OAuth2 token URL. An attacker who controls that value can redirect the token request to an attacker-controlled server and capture client credentials. The fix in 0.45.2 validates tenant_subdomain against RFC 1123 DNS label rules. For consumers that cannot upgrade immediately, the advisory suggests validating tenant_subdomain against an allowlist of registered tenant subdomains before passing it to any SDK call. The reporter is credited as SunandM. The SAP portal lists the vector as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; the GitHub advisory and NVD text show A:N, which is inconsistent with the 10.0 score, so the SAP portal vector is used here.

CVE-2026-89110 (CVSS 9.9, CWE-749, SAP Note 3797111) is a broken access control flaw in SAP NetWeaver Visual Composer (VC70RUNTIME 7.50). Insufficient authorization checks in certain portal functionality let a low-privileged, network-reachable attacker perform unauthorized operations on remote systems, with scope change and high confidentiality, integrity and availability impact.

CVE-2026-89107 (CVSS 9.9, CWE-94, SAP Note 3805589) is a code injection flaw in SAP S/4HANA Manage Substitution/Validation Rules (S4CORE 105-109). Input processed by rule definitions that use domain-specific scripting is insufficiently validated, so an authorized attacker can inject crafted code that is interpreted as executable ABAP.

CVE-2026-89108 (CVSS 9.1, SAP Note 3798788) is a missing authorization check in SAP Manufacturing Integration & Intelligence (XMII 15.4, 15.5) that requires high privileges. High-severity items include SQL injection in SAP Commerce Cloud (CVE-2026-89113, 8.8, COM_CLOUD 2211-JDK21), memory corruption in the Internet Communication Manager of NetWeaver/Web Dispatcher (CVE-2026-58249, 7.5, availability impact, SAP Note 3626303) and missing authorization in ABAP Platform KERNEL 7.93/9.16 (CVE-2026-89120, 7.1).

The bulletin reports no active exploitation, public exploit availability or attribution. The seven CVEs tracked in this record were not found in the portion of the CISA KEV catalog that could be read (first 100,000 characters of a roughly 1.78M-character feed), so the KEV check is partial. No network IOCs are published, so no BeaconBeagle correlation was possible. Defenders should prioritize patching and review authorization, rule-definition and OAuth token-request telemetry.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1528 Steal Application Access Token
- T1550.001 Application Access Token
- T1565 Data Manipulation
- T1210 Exploitation of Remote Services
- T1499.004 Endpoint Denial of Service
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1212 Exploitation for Credential Access
- T1078.004 Valid Accounts: Cloud Accounts

## Sources

- [SAP Support Portal - Security Notes October 2026](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html)
- [SAP Patches Critical NetWeaver and S/4HANA Security Flaws Affecting Enterprise Systems](https://gbhackers.com/sap-patches-critical-netweaver-and-s-4hana-security-flaws/)
- [GHSA-4mv3-jxxm-9cx2: OAuth2 SSRF in SAP Cloud SDK for Python](https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2)
- [NVD - CVE-2026-89111](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-89111)
- [NVD - CVE-2026-89110](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-89110)
- [NVD - CVE-2026-89107](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-89107)
- [SAP Note 3797111 - CVE-2026-89110 Visual Composer](https://me.sap.com/notes/3797111)
- [SAP Note 3805589 - CVE-2026-89107 S/4HANA](https://me.sap.com/notes/3805589)
- [SAP Security Patch Day landing page](https://url.sap/sapsecuritypatchday)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3412