SAP Security Patch Day: October 2026

Our summary

October 2026 Patch Day (13 October): SAP published CVE records for 20 entries: 16 new SAP security notes and 4 GitHub advisories for SAP open-source libraries (updates to earlier notes are not covered). Four are Critical by CVSS, led by a CVSS 10.0 SSRF in SAP Cloud SDK for Python and two 9.9 flaws in SAP NetWeaver Visual Composer and SAP S/4HANA. None of this month’s CVEs is in the CISA KEV catalog (16 October 2026 release).

By priority (derived from CVSS, not SAP’s priority): 4 Critical, 3 High, 12 Medium and 1 Low. Most of the Medium notes are cross-site scripting and missing-authorization fixes in SAP NetWeaver Enterprise Portal, SAPUI5 and the ABAP stack.

Visual Composer is worth extra attention. Two SAP CVEs that CISA added to the KEV catalog in 2025, CVE-2025-31324 and CVE-2025-42999 (notes 3594142 and 3604119), are in the SAP NetWeaver Visual Composer development server. This month’s note 3797111 (CVE-2026-89110, CVSS 9.9) is a broken-access-control issue in SAP NetWeaver Visual Composer (VC70RUNTIME 7.50). Read each note in SAP for Me (SAP login required) before you patch.

Three of the four GitHub advisories are for developer tooling and libraries (cla-assistant, yeoman-ui, cloud-security-services-integration-library). They are fixed by upgrading the package, not by applying an SAP note.

What to patch first

Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.

1. 1
   3797111CriticalCVSS 9.9

   Broken Access Control in SAP NetWeaver Visual Composer

   CVSS 9.9, network-reachable with low privileges (AV:N/PR:L), in SAP NetWeaver Visual Composer; two 2025 Visual Composer CVEs are in CISA KEV.

2. 2
   3805589CriticalCVSS 9.9

   Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)

   CVSS 9.9 code injection in S/4HANA Manage Substitution/Validation Rules (S4CORE 105–109); affects core ERP systems.

3. 3
   GHSA-4mv3-jxxm-9cx2CriticalCVSS 10.0

   OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

   CVSS 10.0, unauthenticated SSRF. If you use SAP Cloud SDK for Python, upgrade to 0.45.2 or later.

4. 4
   3798788CriticalCVSS 9.1

   Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)

   CVSS 9.1 missing authorization in SAP MII Configuration Service (XMII 15.4, 15.5).

5. 5
   3765424HighCVSS 7.5

   Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)

   CVSS 7.5, unauthenticated memory corruption in the ICM, which also ships in SAP Web Dispatcher. Web Dispatcher is often internet-facing.

Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)