Patch Day: October 2026
Released October 13, 2026 · 22 notes · Source: SAP Security Patch Day page
Scheduled for October 13, 2026 (second Tuesday)
- New
- 20
- Updated
- 2
- Critical
- 4
- High
- 3
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
October 2026 Patch Day (13 October) brought 22 entries: 16 new SAP security notes, 4 GitHub advisories for SAP open-source libraries, and 2 updated notes. Four are rated Critical, led by a CVSS 10.0 SSRF in SAP Cloud SDK for Python and two 9.9 flaws in SAP NetWeaver Visual Composer and SAP S/4HANA. None of this month’s CVEs is in the CISA KEV catalog (16 October 2026 release).
By priority: 4 Critical, 3 High, 14 Medium and 1 Low. Most of the Medium notes are cross-site scripting and missing-authorization fixes in SAP NetWeaver Enterprise Portal, SAPUI5 and the ABAP stack.
Visual Composer is worth extra attention. Two SAP CVEs that CISA added to the KEV catalog in 2025, CVE-2025-31324 and CVE-2025-42999 (notes 3594142 and 3604119), are in the SAP NetWeaver Visual Composer development server. This month’s note 3797111 (CVE-2026-89110, CVSS 9.9) is a broken-access-control issue in SAP NetWeaver Visual Composer (VC70RUNTIME 7.50).
Three of the four GitHub advisories are for developer tooling and libraries (cla-assistant, yeoman-ui, cloud-security-services-integration-library). They are fixed by upgrading the package, not by applying an SAP note.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Broken Access Control in SAP NetWeaver Visual Composer
CVSS 9.9, network-reachable with low privileges (AV:N/PR:L), in SAP NetWeaver Visual Composer; two 2025 Visual Composer CVEs are in CISA KEV.
Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)
CVSS 9.9 code injection in S/4HANA (S4CORE 105–109); affects core ERP systems.
OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
CVSS 10.0, unauthenticated SSRF. If you use SAP Cloud SDK for Python, upgrade to 0.45.2 or later.
Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)
CVSS 9.1 missing authorization in SAP MII Configuration Service (XMII 15.4, 15.5).
Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
CVSS 7.5, unauthenticated memory corruption in the ICM, which also ships in SAP Web Dispatcher. Web Dispatcher is often internet-facing.
All notes
SAP’s introduction states 16 new notes and 2 updates; SAP’s table lists 22 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 22 of 22
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| GHSA-4mv3-jxxm-9cx2 | OAuth2 SSRF vulnerability in SAP Cloud SDK for Python New | SAP Cloud SDK for Python | Critical | 10.0 | CVE-2026-89111 |
| 3797111 | Broken Access Control in SAP NetWeaver Visual Composer New | SAP NetWeaver Visual Composer | Critical | 9.9 | CVE-2026-89110 |
| 3805589 | Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) New | SAP S/4HANA | Critical | 9.9 | CVE-2026-89107 |
| 3798788 | Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) New | SAP Manufacturing Integration and Intelligence | Critical | 9.1 | CVE-2026-89108 |
| 3800517 | SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) New | SAP Commerce Cloud | High | 8.8 | CVE-2026-89113 |
| 3765424 | Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) New | SAP NetWeaver and SAP Web Dispatcher | High | 7.5 | CVE-2026-58249 |
| 3626303 | Missing authorization check in SAP ABAP Platform New | SAP ABAP Platform | High | 7.1 | CVE-2026-89120 |
| 3798823 | Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | Medium | 6.5 | CVE-2026-76972 |
| GHSA-8rcv-xqgf-8743 | Broken Access Control in CLA-Assistant — CLA Signature PII Disclosure New | cla-assistant | Medium | 6.5 | CVE-2026-89112 |
| 3689080 | Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.4 | CVE-2026-24316 |
| 3629325 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2025-42938 |
| 3779985 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.1 | CVE-2026-89117 |
| 3790401 | Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.1 | CVE-2026-89122 |
| 3794572 | Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) New | SAPUI5 | Medium | 6.1 | CVE-2026-76975 |
| GHSA-vm9q-mf35-jwpx | OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code New | yeoman-ui | Medium | 5.9 | CVE-2026-89116 |
| 3671819 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.4 | CVE-2026-76976 |
| 3789825 | Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 5.3 | CVE-2026-89118 |
| 3799621 | Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) New | SAP S/4HANA | Medium | 4.7 | CVE-2026-89121 |
| 3799054 | Cross Site Scripting (XSS) vulnerability in SAPUI5 New | SAPUI5 | Medium | 4.4 | CVE-2026-89106 |
| 3810872 | Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration) New | SAP HANA | Medium | 4.3 | CVE-2026-89124 |
| GHSA-857v-p42q-f3qf | Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library New | SAP/cloud-security-services-integration-library | Medium | 4.2 | CVE-2026-89105 |
| 3767634 | Improper Authorization check in SAP Cloud Connector New | SAP Cloud Connector | Low | 3.5 | CVE-2026-58242 |