SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a maximum-severity vulnerability in the Cloud SDK for Python.
The SAP Python SDK is the official programmatic toolkit for developing AI agents and Python applications on the company’s SAP Business Technology Platform (BTP) services.
Tracked as CVE-2026-89111, the maximum-severity vulnerability patched this month can be exploited by remote attackers without privileges to steal credentials.
Customers who can’t immediately deploy the October 2026 SAP patches can temporarily mitigate the issue by using an allowlist to validate tenant_subdomain values.
“The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated,” according to a Tuesday advisory.
“Consumer applications can mitigate the vulnerability by validating tenant_subdomain against a known allowlist of registered tenant subdomains before passing it to any SDK call.”
Today, SAP also addressed CVE-2026-89110, a critical broken access control vulnerability in the SAP NetWeaver Visual Composer that could let remote attackers with limited privileges fully compromise vulnerable systems.
Another critical flaw patched today in SAP Manufacturing Integration and Intelligence (tracked as CVE-2026-89108) lets threat actors with administrator privileges gain admin control over the underlying system by provisioning an elevated-privilege account on the underlying Java app.
In recent months, SAP has fixed several other maximum-severity flaws in multiple components. For instance, it patched CVE-2026-58231 in the Commerce Cloud cloud-based e-commerce platform in August, which threat intelligence firm Defused flagged as actively exploited in attacks days after it was addressed.
More recently, in September, it also fixed the CVE-2026-44756 memory corruption flaw in the SAP Kernel code, dubbed OVERPASS by Onapsis security researchers who reported it. According to Onapsis estimates at the time, over 10,000 Internet-facing SAP systems use the vulnerable component and may be exposed to attacks that exploit CVE-2026-44756.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 14 SAP security flaws to its catalog of actively exploited vulnerabilities since November 2021, three of which were abused in ransomware attacks.
SAP is a German multinational software company that serves 99 of the 100 largest companies worldwide and reported revenues exceeding €36 billion in fiscal year 2025.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Max severity SonicWall SMA1000 flaw now exploited in attacks
SonicWall warns of max severity SSRF flaw in SMA1000 gateways
Cisco warns of critical flaws allowing Nexus switch takeover
SonicWall warns of actively exploited SMA1000 zero-day flaws
SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now
Ledger confirms spy chip implant behind wallet crypto thefts
Nippon Columbia malware incident exposes 8.6 million karaoke fan records
Cyberattack shuts down refrigerators at French supermarkets
Is your backup really out of reach? See what the latest attacks reveal.
Overdue a password health-check? Audit your Active Directory for free
Move from visibility to action with AITEM, Criminal IP’s next evolution of ASM
New OAuth risk analyst agent: Turn 45 minutes of manual review into 15 seconds.
AWS saw a valid key and let the agent clear a production bucket. See how Token Security ties each agent to its owner and limits it to read-only access.
AI is a data-breach time bomb: Read the new report
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
