Security1 hOctober 13, 2026, 20:51

SAP patches 20 flaws, including max-severity OAuth2 SSRF in Cloud SDK for Python

SAP released its October 2026 security updates, fixing 20 vulnerabilities. The maximum-severity CVE-2026-89111 in the Cloud SDK for Python lets unprivileged attackers redirect OAuth2 token requests and steal credentials. Critical flaws in NetWeaver Visual Composer and MII were also patched.

BleepingComputer

Open source

SAP patches 20 flaws, including max-severity OAuth2 SSRF in Cloud SDK for Python

CVE-2026-89111 in SAP Cloud SDK for Python rated maximum severity, leaks OAuth2 credentials
Critical CVE-2026-89110 in NetWeaver Visual Composer allows full system compromise
CVE-2026-89108 in MII lets admins provision elevated-privilege accounts
Mitigation: validate tenant_subdomain against an allowlist until patches are applied

#SAP#Python

MCP SDK OAuth fix audit: patching alone leaves the hole open

Security

MCP Python SDK OAuth flaw lets malicious servers steal client secrets

Business

DSAG: 54% of SAP customers still on ECC as users demand cloud parity

Policy

SAP patches 20 flaws, including max-severity OAuth2 SSRF in Cloud SDK for Python

MCP SDK OAuth fix audit: patching alone leaves the hole open

MCP Python SDK OAuth flaw lets malicious servers steal client secrets

DSAG: 54% of SAP customers still on ECC as users demand cloud parity

European cloud watchdog slams Broadcom over VMware licensing, warns on SAP