Latest Patch Day
Patch Day: October 2026
Released October 13, 2026 · 22 notes · Source: SAP Security Patch Day page
October 2026 Patch Day (13 October) brought 22 entries: 16 new SAP security notes, 4 GitHub advisories for SAP open-source libraries, and 2 updated notes. Four are rated Critical, led by a CVSS 10.0 SSRF in SAP Cloud SDK for Python and two 9.9 flaws in SAP NetWeaver Visual Composer and SAP S/4HANA. None of this month’s CVEs is in the CISA KEV catalog (16 October 2026 release).
Next Patch Day
in 23 days, 8 hours, 6 minutes
Counted to midnight US Eastern Time; SAP publishes on the second Tuesday of each month.
- New
- 20
- Updated
- 2
- Critical
- 4
- High
- 3
- Highest CVSS
- 10.0
- Known exploited
- 0
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Broken Access Control in SAP NetWeaver Visual Composer
CVSS 9.9, network-reachable with low privileges (AV:N/PR:L), in SAP NetWeaver Visual Composer; two 2025 Visual Composer CVEs are in CISA KEV.
Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)
CVSS 9.9 code injection in S/4HANA (S4CORE 105–109); affects core ERP systems.
OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
CVSS 10.0, unauthenticated SSRF. If you use SAP Cloud SDK for Python, upgrade to 0.45.2 or later.
Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)
CVSS 9.1 missing authorization in SAP MII Configuration Service (XMII 15.4, 15.5).
Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
CVSS 7.5, unauthenticated memory corruption in the ICM, which also ships in SAP Web Dispatcher. Web Dispatcher is often internet-facing.