Security1 hOctober 14, 2026, 13:12

SAP Patches Four Critical NetWeaver and S/4HANA Vulnerabilities

SAP released 22 security notes, including four critical fixes. The most severe, CVE-2026-89111 (CVSS 10/10), is an OAuth2 SSRF in the Cloud SDK for Python that can exfiltrate client credentials in multi-tenant BTP apps. Also patched: CVE-2026-89110 and CVE-2026-89107 (9.9 each) and CVE-2026-89108 (9.1).

SecurityWeek

Open source

SAP Patches Four Critical NetWeaver and S/4HANA Vulnerabilities

CVE-2026-89111 (CVSS 10/10): SSRF in Cloud SDK for Python leaks OAuth2 tokens
CVE-2026-89110 (9.9): broken access control in NetWeaver enables ABAP code execution
CVE-2026-89107 (9.9): code injection in S/4HANA via Visual Composer
CVE-2026-89108 (9.1): missing authorization in XMII allows full system compromise

#SAP#NetWeaver#S/4HANA

Cisco patches 35 vulnerabilities, over a dozen rated critical

Security

Adobe Patches 36 Vulnerabilities, Including Critical Flaws in Connect and AEM Forms

Security

Chrome 154 patches 108 vulnerabilities, including 11 critical

Business

SAP Patches Four Critical NetWeaver and S/4HANA Vulnerabilities

Cisco patches 35 vulnerabilities, over a dozen rated critical

Adobe Patches 36 Vulnerabilities, Including Critical Flaws in Connect and AEM Forms

Chrome 154 patches 108 vulnerabilities, including 11 critical

DSAG: 54% of SAP customers still on ECC as users demand cloud parity