Enterprise software maker SAP on Tuesday announced the release of 22 new and updated security notes, including four that address critical-severity vulnerabilities.
At the top of the list is CVE-2026-89111 (CVSS score of 10/10), an OAuth2 SSRF vulnerability in Cloud SDK for Python that impacts multi-tenant BTP applications.
“An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated,” SAP explains in a GitHub advisory.
Next in line is CVE-2026-89110 (CVSS score of 9.9/10), a broken access control in certain portal functionality of NetWeaver Visual Composer.
According to enterprise application security firm Onapsis, the flaw could allow “a low-privileged attacker to invoke internal operations on a preconfigured remote system” and fully compromise it.
The third critical-severity vulnerability resolved on SAP’s October 2026 Security Patch Day is CVE-2026-89107 (CVSS score of 9.9/10), a code injection issue in S/4HANA that could allow authenticated attackers to execute arbitrary ABAP code on the system.
The security defect exists because the rule definition process fails to properly validate input, allowing attackers holding a specific business role in the Fiori Applications to submit crafted input. Successful exploitation could allow attackers to take over a vulnerable system, Onapsis explains.