SAP Security Patch October 2026

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Critical

CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, CVE-2026-89108

SAP

October 13, 2026

Executive Summary

Twenty-two CVEs, including CVE-2026-89111 (CVSS 10) and two CVSS 9.9 flaws in NetWeaver Visual Composer and S/4HANA.

Key Details

Affected Platform

SAP

Attack Surface

Recommended Action

Affected Environment

SAP Cloud SDK for Python, NetWeaver, S/4HANA, Manufacturing Integration and Intelligence, Commerce Cloud, ABAP Platform, and Cloud Connector.

Operational Impact

Credential theft, remote system compromise, ABAP code execution, data exposure, and availability loss on business critical SAP systems.

Technical Root Cause

OAuth2 SSRF, broken access control, ABAP code injection, missing authorization checks, SQL injection, memory corruption, and XSS.

Recommended Mitigation

Apply SAP's October 2026 security notes, prioritising CVE-2026-89111, CVE-2026-89110, CVE-2026-89107, and CVE-2026-89108.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

SAP Security Notes.