Key points
- Four critical vulnerabilities were fixed in the October 2026 update cycle.
- CVE-2026-89107 allows code execution in S/4HANA substitution rules.
- CVE-2026-58249 causes remote crashes in NetWeaver and Web Dispatcher.
SAP released its October 2026 security updates on October 13, addressing critical flaws in core business applications. The patch cycle includes 16 new security notes and fixes for code injection, access control, and cloud security issues.
The release covers S/4HANA, NetWeaver, Web Dispatcher, Commerce Cloud, and development libraries. Four entries carry critical ratings, making this update essential for teams managing these environments.
Critical Vulnerabilities Details
CVE-2026-89107 affects the Manage Substitution/Validation Rules feature in SAP S/4HANA. Rated 9.9, it allows authenticated attackers with specific business privileges to execute arbitrary ABAP code. This flaw exists because the system fails to properly validate input written in a scripting language used for business rules.
According to Onapsis, successful exploitation could give attackers broad control over the affected system. The published CVSS vector indicates low attack complexity and no need for user interaction, though an account with suitable business permissions is required.
Who Is Affected
CVE-2026-58249 impacts the Internet Communication Manager in SAP NetWeaver and Web Dispatcher. Rated 7.5, this high-severity flaw allows remote attackers to crash processes without authentication. The issue stems from improper checking of fields in crafted requests handled by an internal protocol component.
SecurityWeek reported that CVE-2026-89111, a critical OAuth2 SSRF in Cloud SDK for Python, also affects multi-tenant BTP applications. Additionally, CVE-2026-89108 allows XMII Admins to create administrator accounts in Manufacturing Integration and Intelligence.
Next steps
SAP has not confirmed any of these defects are being exploited in the wild. Users are advised to update their applications as soon as possible. The fixes are delivered through specific security notes and GitHub advisories listed in the October bulletin.
Signals worth monitoring
Teams should review authentication logs for unusual activity from accounts with business privileges, especially those accessing rule definition features. Monitor for unexpected process crashes in NetWeaver or Web Dispatcher components, which may indicate exploitation of memory handling errors. Check for outbound connections to unknown servers from applications using OAuth2, as this could signal credential exfiltration via SSRF.
What to do and how to stay safe: SAP
- Verify if your environment runs affected versions of S/4HANA, NetWeaver, or Commerce Cloud.
- Review access logs for authenticated users with business roles performing unusual rule changes.
- Monitor network traffic for unexpected outbound connections from BTP applications.
- Apply the October 2026 security notes once the vendor provides an update.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which SAP products are affected by the October 2026 patches?
S/4HANA, NetWeaver, Web Dispatcher, Commerce Cloud, and development libraries are affected.
Is CVE-2026-89107 being exploited in the wild?
SAP makes no mention of any of the newly resolved security defects being exploited in the wild.
What is the severity of the NetWeaver memory corruption flaw?
CVE-2026-58249 is rated high severity with a CVSS score of 7.5.
