SAP Releases Critical Security Patches for NetWeaver and S/4HANA

Post Views: 1

Enterprise software provider SAP released 22 security updates on Tuesday, including four critical-severity flaws affecting key platforms.

Critical Vulnerabilities in NetWeaver and S/4HANA

SAP addressed multiple critical vulnerabilities in its NetWeaver and S/4HANA platforms during the October 2026 Security Update. These flaws pose significant risks to enterprise systems and require immediate attention.

CVE-2026-89111: OAuth2 SSRF Vulnerability in Cloud SDK for Python

This flaw involves an OAuth2 server-side request forgery (SSRF) vulnerability in the Cloud SDK for Python. It impacts multi-tenant BTP applications and allows an attacker controlling the tenant_subdomain parameter to redirect OAuth2 token requests to a malicious server, leading to the theft of client credentials. A GitHub advisory from SAP details this risk.

CVE-2026-89110: Broken Access Control in NetWeaver Visual Composer

This critical vulnerability stems from a broken access control flaw in specific portal functionalities of NetWeaver Visual Composer. According to enterprise security firm Onapsis, this defect enables a low-privilege attacker to execute internal operations on a preconfigured remote system, resulting in full system compromise.

CVE-2026-89107: Code Injection in S/4HANA

A code injection vulnerability in S/4HANA arises from insufficient input validation during the rule definition process. This allows authenticated users with a specific business role in Fiori Applications to submit malicious input. Exploitation could grant attackers arbitrary ABAP code execution on the system, according to Onapsis.

CVE-2026-89108: Missing Authorization Check in Manufacturing Integration and Intelligence

This flaw permits an attacker with XMII Admin privileges to create an administrator account on the underlying Java application server, enabling full system compromise. The vulnerability highlights risks in access control mechanisms within the Manufacturing Integration and Intelligence module.

Additional High-Severity Issues

In addition to the critical flaws, SAP resolved high-severity issues in Commerce Cloud, NetWeaver, and ABAP Platform. These include vulnerabilities that could allow SQL injection, process crashes, and restriction bypasses. No evidence of active exploitation has been reported.

Recommendations for Users

Users are strongly advised to apply the security patches promptly to mitigate risks associated with these vulnerabilities. The updates are part of SAP’s regular Security Patch Day cycle, which addresses emerging threats across its product portfolio.

According to Onapsis, the vulnerabilities in NetWeaver Visual Composer and S/4HANA could lead to full system compromise if exploited.