Latest Patch Day
SAP Security Patch Day: October 2026
Released October 13, 2026 · 20 notes · Source: CVE records on CVE.org (SAP as CNA)
October 2026 Patch Day (13 October): SAP published CVE records for 20 entries: 16 new SAP security notes and 4 GitHub advisories for SAP open-source libraries (updates to earlier notes are not covered). Four are Critical by CVSS, led by a CVSS 10.0 SSRF in SAP Cloud SDK for Python and two 9.9 flaws in SAP NetWeaver Visual Composer and SAP S/4HANA. None of this month’s CVEs is in the CISA KEV catalog (16 October 2026 release).
Next Patch Day
in 11 days, 0 hours, 56 minutes
Counted to midnight US Eastern Time; SAP publishes on the second Tuesday of each month.
- SAP notes
- 16
- GitHub advisories
- 4
- Critical
- 3
- High
- 3
- Highest CVSS
- 9.9
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required). Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Broken Access Control in SAP NetWeaver Visual Composer
CVSS 9.9, network-reachable with low privileges (AV:N/PR:L), in SAP NetWeaver Visual Composer; two 2025 Visual Composer CVEs are in CISA KEV.
Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)
CVSS 9.9 code injection in S/4HANA Manage Substitution/Validation Rules (S4CORE 105–109); affects core ERP systems.
OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
CVSS 10.0, unauthenticated SSRF. If you use SAP Cloud SDK for Python, upgrade to 0.45.2 or later.
Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)
CVSS 9.1 missing authorization in SAP MII Configuration Service (XMII 15.4, 15.5).
Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
CVSS 7.5, unauthenticated memory corruption in the ICM, which also ships in SAP Web Dispatcher. Web Dispatcher is often internet-facing.
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)