SAP Patches Critical Code Injection, Memory Corruption Bugs

Key Takeaways

• SAP has released its October 2026 security updates, addressing a total of 22 vulnerabilities.
• Four critical flaws, including code injection and OAuth2 server-side request forgery, are among the fixes.
• Affected products span SAP S/4HANA, NetWeaver, Web Dispatcher, Commerce Cloud, and various development libraries.
• Customers are strongly advised to apply these patches immediately to mitigate significant risks.

SAP Addresses Critical Vulnerabilities in October 2026 Security Release

SAP has issued its comprehensive security updates for October 2026, delivering crucial patches for a range of vulnerabilities. This release tackles critical issues such as code injection, access control bypasses, and cloud security weaknesses, alongside a high-severity memory corruption flaw.

The October 13 patch cycle introduces 16 new security notes, incorporates four GitHub security advisories, and provides updates to two previously released notes. Four of these entries are rated critical, underscoring the urgency for organizations utilizing SAP business systems to implement these corrective measures.

According to SAP’s October Patch Day bulletin, the patches target a broad spectrum of SAP products. This includes core systems like S/4HANA and NetWeaver, as well as components such as Web Dispatcher, Commerce Cloud, and several foundational development libraries.

While critical vulnerabilities dominate the headlines, it’s important to note that a significant memory corruption flaw, though rated high severity rather than critical, could lead to service disruption. Its impact is primarily on system availability, with no confirmed implications for data confidentiality or integrity.

In total, the 22 security entries consist of four critical, three high, 14 medium, and one low-severity issue. This count includes the two updated notes and four library advisories.

Deep Dive into Critical SAP Security Vulnerabilities

One of the most severe vulnerabilities, Security Note 3805589, addresses CVE-2026-89107, a critical code injection flaw with a CVSS score of 9.9. This vulnerability impacts the Manage Substitution/Validation Rules feature within SAP S/4HANA, specifically affecting S4CORE versions 105, 106, 107, 108, and 109.

The flaw stems from insufficient input validation in the rule definition feature, which processes scripting language used for business rules. An authenticated attacker, possessing specific business privileges, could inject specially crafted input. This input would then be erroneously interpreted and executed as ABAP code, SAP’s proprietary programming language.

Successful exploitation of CVE-2026-89107 could grant an attacker extensive control over the compromised system, posing severe risks to data privacy, integrity, and system availability. Although the attack requires an authenticated account with appropriate business permissions, the CVSS vector indicates low attack complexity and no user interaction is required for exploitation.

Another significant vulnerability, CVE-2026-58249, affects the Internet Communication Manager (ICM) component in both SAP NetWeaver and SAP Web Dispatcher. Rated at 7.5 CVSS, this memory corruption flaw is mitigated by Security Note 3765424. Crucially, a remote attacker can exploit this weakness without authentication by sending a malicious request.

The vulnerability arises from the affected software’s failure to properly validate certain fields within specially crafted requests processed by an internal protocol component. This can trigger a memory handling error, leading to a crash of the affected process. While the primary impact is a high risk to availability, confidentiality and integrity remain unaffected.

The list of affected software for CVE-2026-58249 is extensive, encompassing HDB 2.00, various kernel and Web Dispatcher releases, Content Server, XS Advanced Runtime, and SAP Extended Application Services. Administrators are advised to meticulously compare their installed components against the full vendor list to ensure all necessary updates are applied.

The highest-rated vulnerability in this cycle is CVE-2026-89111, an OAuth2 server-side request forgery (SSRF) flaw in SAP Cloud SDK for Python, achieving a perfect CVSS score of 10.0. This critical issue affects versions prior to 0.45.2.

In applications operating with multiple tenants on the SAP Business Technology Platform, an attacker can manipulate the tenant_subdomain parameter. This manipulation allows for the redirection of token requests to an attacker-controlled server, potentially exposing sensitive client credentials.

SAP also addressed CVE-2026-89110, a broken access control vulnerability in NetWeaver Visual Composer VC70RUNTIME 7.50, rated 9.9. Another critical flaw, CVE-2026-89108, concerns a missing authorization check in the Configuration Service of Manufacturing Integration and Intelligence versions 15.4 and 15.5, with a CVSS score of 9.1.

Earlier reports highlighted how vulnerabilities in SAP NetWeaver, specifically Visual Composer weaknesses, have previously been exploited as zero-days to gain access to business networks. While HackersRadar and other outlets, including Cyber Security News, covered CISA’s warnings about an exploited SAP flaw (CVE-2025-31324), there is no current evidence that the newly disclosed vulnerabilities are under active exploitation.

What You Should Do

• Prioritize the application of all critical and high-severity patches released in the October 2026 security update.
• Thoroughly review the October Patch Day bulletin and relevant security notes to identify all affected products and components within your environment.
• For SAP Cloud SDK users, upgrade to version 0.45.2 or later and verify which applications utilize the affected library.
• Include updates for earlier SSRF and scripting issues covered by the two revised notes in your patch review process.
• Develop a clear patching strategy that balances business needs with the imperative of immediate security remediation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.