SAP Warns of Critical OAuth2 SSRF Vulnerability

Post Views: 10

SAP released updates addressing 20 vulnerabilities across multiple products in its October 2026 security patches, including a critical flaw in the Cloud SDK for Python.

SAP’s October 2026 Security Patches

SAP released updates addressing 20 vulnerabilities across multiple products in its October 2026 security patches, including a critical flaw in the Cloud SDK for Python. The SAP Python SDK serves as the primary development toolkit for building AI agents and Python-based applications on the SAP Business Technology Platform (BTP) services. This specific vulnerability, designated CVE-2026-89111, allows remote attackers without authentication to exploit an OAuth2 server-side request forgery (SSRF) flaw, enabling credential theft. Affected systems include multi-tenant BTP applications where the tenant_subdomain parameter is not properly validated. Attackers could manipulate this parameter to redirect OAuth2 token requests to malicious servers, leading to the unauthorized exfiltration of client credentials. SAP recommends immediate patch deployment, though organizations unable to apply updates promptly should implement an allowlist validation mechanism for tenant_subdomain values.

Critical OAuth2 SSRF Flaw in SAP Python SDK

In addition to the OAuth2 SSRF issue, SAP resolved CVE-2026-89110, a critical access control flaw in the SAP NetWeaver Visual Composer. This vulnerability could allow threat actors with limited privileges to fully compromise vulnerable systems. Another critical flaw, CVE-2026-89108, affects the SAP Manufacturing Integration and Intelligence platform, enabling administrators to create elevated-privilege accounts on underlying Java applications.

Past Vulnerabilities and Recent Fixes

These updates follow a series of recent patches addressing high-severity vulnerabilities. For example, in August 2026, SAP addressed CVE-2026-58231 in the Commerce Cloud e-commerce platform, which was reported to be actively exploited shortly after disclosure. Earlier in September, the SAP Kernel code’s CVE-2026-44756 memory corruption flaw, named OVERPASS by Onapsis researchers, was resolved. At the time of its discovery, over 10,000 internet-facing SAP systems were identified as potentially exposed to attacks leveraging this vulnerability.

CISA’s Documented SAP Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has documented 14 SAP vulnerabilities in its actively exploited list since November 2021, with three of these linked to ransomware incidents.

SAP’s Role and Industry Impact

SAP, a leading enterprise software provider, supports 99 of the world’s 100 largest companies and reported annual revenues surpassing 36 billion euros in fiscal year 2025. The company’s latest updates emphasize the importance of timely patch management to mitigate risks associated with SSRF, access control failures, and privilege escalation vectors. Organizations are advised to review their SAP environments for affected components and apply patches as soon as possible to prevent potential exploitation.