SAP October 2026 Security Updates Fix 20 Flaws, Including Critical Cloud SDK OAuth SSRF
SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including maximum-severity vulnerabilities in SAP Cloud SDK for Python.
SAP Cloud SDK for Python is the company’s official toolkit for developing AI agents and Python applications that run on SAP Business Technology Platform (BTP) services.
Critical SAP Cloud SDK for Python OAuth2 SSRF flaw
Tracked as CVE-2026-89111, the maximum-severity vulnerability could allow an unauthorized remote attacker to steal credentials.
The flaw is an OAuth2 server-side request forgery (SSRF) vulnerability affecting multi-tenant BTP applications. According to a security advisory, an attacker who controls the tenant_subdomain parameter could redirect OAuth2 token requests to an attacker-controlled server and steal client credentials.
Customers who cannot immediately deploy the October 2026 SAP patch can temporarily reduce the risk by validating the tenant_subdomain value against an allow list of registered tenant subdomains before passing it to the SDK.
Other critical SAP vulnerabilities patched
SAP also announced CVE-2026-89110, a critical access-control vulnerability in SAP NetWeaver Visual Composer. A remote attacker with limited privileges could exploit the flaw to completely compromise a vulnerable system.
Another critical vulnerability was fixed in SAP Manufacturing Integration and Intelligence. Tracked as CVE-2026-89108, the flaw could allow an attacker with administrative privileges to gain control of the underlying system by provisioning an elevated-privilege account in the Java application.
Recent SAP vulnerabilities and active exploitation
In recent months, SAP has fixed several other maximum-severity vulnerabilities across multiple components. In August, SAP patched CVE-2026-58231 in its cloud-based Commerce Cloud e-commerce platform. Threat intelligence firm Defused reported that the vulnerability was actively exploited in attacks days after disclosure.
In September, SAP addressed a memory-corruption flaw in SAP kernel code known as Overpass. Tracked as CVE-2026-44756, the vulnerability was reported by Onapsis security researchers. Onapsis estimated that more than 10,000 internet-facing SAP systems were using the vulnerable component and could be exposed to attacks exploiting the flaw.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 14 SAP security flaws to its Known Exploited Vulnerabilities catalog since November 2021. Three of those vulnerabilities were exploited in ransomware attacks.
SAP is a German multinational software company that serves 99 of the world’s 100 largest companies. The company reported revenue of more than 36 billion euros in 2025.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a two-hour digital summit about what will change with AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.
Source: www.bleepingcomputer.com