SAP Security Update Patches Critical Code Injection and Memory Corruption Vulnerabilities

SAP has released its October 2026 security updates, fixing critical code injection, access control, and cloud security flaws alongside a high-severity memory corruption issue.

The October 13 release includes 16 new security notes, four GitHub security advisories and two updates to earlier notes. Four entries carry critical ratings, making this patch cycle important for teams running SAP business systems.

According to SAP’s October Patch Day bulletin, the fixes cover S/4HANA, NetWeaver, Web Dispatcher, Commerce Cloud and several development libraries.

Although the headline highlights critical vulnerabilities, the memory corruption flaw is rated High, not Critical. Its published impact concerns service disruption rather than confirmed code execution or data theft.

Across all 22 entries, SAP lists four critical, three high, 14 medium, and one low severity issues, including the two updated notes and four library advisories.

SAP Security Vulnerabilities

CVE-2026-89107 carries a CVSS score of 9.9 and affects the Manage Substitution/Validation Rules feature in SAP S/4HANA. SAP lists S4CORE versions 105, 106, 107, 108 and 109 as affected, with the correction delivered through Security Note 3805589.

The weakness lies in how the rule definition feature checks input written in a scripting language used for business rules. An authenticated attacker with specific business privileges can submit crafted input that the system treats as executable ABAP code, SAP’s programming language.

Successful exploitation could give an attacker broad control over the affected system, with serious effects on data privacy, data accuracy, and service availability. The attack requires an account with suitable business permissions, but the published CVSS vector indicates low attack complexity and no need for another user to interact.

CVE-2026-58249 affects the Internet Communication Manager component in SAP NetWeaver and SAP Web Dispatcher. Rated 7.5, the flaw is addressed by Security Note 3765424. A remote attacker does not need to authenticate before sending a malicious request.

The affected software fails to properly check certain fields in crafted requests handled by an internal protocol component. This can trigger a memory handling error and crash the affected process. The published description reports a high impact on availability, with no impact on confidentiality or integrity.

SAP’s affected version list spans HDB 2.00, multiple kernel and Web Dispatcher releases, Content Server, XS Advanced Runtime and SAP Extended Application Services.

Administrators should compare installed components against the full vendor list rather than assume every deployment needs the same update package.

The highest-rated issue is CVE-2026-89111, an OAuth2 server-side request forgery flaw in SAP Cloud SDK for Python, scored 10.0. It affects versions before 0.45.2.

In applications serving multiple tenants on SAP Business Technology Platform, an attacker controlling the tenant_subdomain parameter can redirect token requests to an attacker-controlled server and expose client credentials.

SAP also fixed CVE-2026-89110, a broken access control flaw in NetWeaver Visual Composer VC70RUNTIME 7.50, rated 9.9. Another critical issue, CVE-2026-89108, concerns a missing authorization check in the Configuration Service of Manufacturing Integration and Intelligence versions 15.4 and 15.5, with a score of 9.1.

Earlier reporting on the SAP NetWeaver zero-day exploited in the wild showed how Visual Composer weaknesses became a route into business networks.

Cyber Security News also covered CISA’s warning about the exploited SAP flaw. Those reports concern CVE-2025-31324, not evidence that these newly disclosed vulnerabilities are being exploited.

SAP urges customers to apply the patches as a priority. Teams should identify affected products, read the relevant security notes, and plan updates around business needs.

Cloud SDK users should move to version 0.45.2 or later and check which applications use the affected library. The release also addresses SQL injection in Commerce Cloud, authorization gaps in ABAP Platform, and several cross-site scripting flaws.

The two revised notes cover earlier SSRF and scripting issues. These updates should remain part of the patch review, even when critical fixes take priority.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post SAP Security Update Patches Critical Code Injection and Memory Corruption Vulnerabilities appeared first on Cyber Security News.