The October SAP Security Patch Day, released on 13 October 2026, contains 22 items: 16 new SAP Security Notes, four GitHub security advisories for open-source libraries and two updates to notes from earlier months. Four are rated critical, three high, fourteen medium and one low. It is also the third month running with a CVSS 10.0 at the top of the list, after SAP Note 3771065 in August and 3747649 in September.
This time the 10.0 is not an SAP Note. It is advisory GHSA-4mv3-jxxm-9cx2 (CVE-2026-89111) for the SAP Cloud SDK for Python below version 0.45.2. There is no note number, nothing to import through SNOTE, no transport and no kernel to swap. The fix is a single version bump in the dependency file of an application running on SAP BTP - provided somebody knows which application pulls the library in.
The short version:
1/ the highest-rated item of the month (10.0) is a Python library used by multi-tenant SAP BTP applications; the development team owns it, not Basis, and the remedy is a package upgrade,
2/ the three critical SAP Notes - 3797111 (Visual Composer, 9.9), 3805589 (S/4HANA, 9.9) and 3798788 (SAP MII, 9.1) - all require an existing account, so the real exposure depends on who holds which roles,
3/ SAP Notes 3797111 and 3805589 both come with workarounds you can apply today, ahead of any maintenance window,
4/ the cycle does not close on the second Tuesday: after the September Patch Day SAP released one more new note and two updates, and SecurityBridge counts them towards October.
SAP Security Notes October 2026 - the full list of 22 items
Below are all items released on 13 October 2026, ordered by CVSS score. The four critical items are in bold. Identifiers starting with GHSA are GitHub advisories for open-source libraries and carry no SAP Note number.
| Item | CVE | CVSS | Component | Vulnerability type |
|---|---|---|---|---|
| GHSA-4mv3-jxxm-9cx2 | CVE-2026-89111 | 10.0 | SAP Cloud SDK for Python | OAuth2 SSRF |
| 3797111 | CVE-2026-89110 | 9.9 | SAP NetWeaver Visual Composer | Broken access control |
| 3805589 | CVE-2026-89107 | 9.9 | S/4HANA validation rules | Code injection |
| 3798788 | CVE-2026-89108 | 9.1 | SAP MII | Missing authorisation check |
| 3800517 | CVE-2026-89113 | 8.8 | SAP Commerce Cloud | SQL injection |
| 3765424 | CVE-2026-58249 | 7.5 | ICM and SAP Web Dispatcher | Memory corruption |
| 3626303 | CVE-2026-89120 | 7.1 | SAP ABAP Platform | Missing authorisation check |
| GHSA-8rcv-xqgf-8743 | CVE-2026-89112 | 6.5 | cla-assistant | Personal data disclosure |
| 3798823 | CVE-2026-76972 | 6.5 | SAP MII | Stored XSS |
| 3689080 | CVE-2026-24316 | 6.4 | SAP NetWeaver AS ABAP | SSRF, note update |
| 3629325 | CVE-2025-42938 | 6.1 | ABAP Platform, CRM | XSS, note update |
| 3779985 | CVE-2026-89117 | 6.1 | SAP Enterprise Portal | XSS |
| 3794572 | CVE-2026-76975 | 6.1 | SAPUI5 Support Assistant | DOM-based XSS |
| 3790401 | CVE-2026-89122 | 6.1 | SAP Enterprise Portal | Open redirect |
| GHSA-vm9q-mf35-jwpx | CVE-2026-89116 | 5.9 | Yeoman-UI for VS Code | OS command injection |
| 3671819 | CVE-2026-76976 | 5.4 | SAP GUI for HTML | XSS |
| 3789825 | CVE-2026-89118 | 5.3 | SAP Enterprise Portal | Information disclosure |
| 3799621 | CVE-2026-89121 | 4.7 | S/4HANA Linear Asset Management | Missing authorisation check |
| 3799054 | CVE-2026-89106 | 4.4 | SAPUI5 | XSS |
| 3810872 | CVE-2026-89124 | 4.3 | SAP GTS for SAP HANA | Missing authorisation check |
| GHSA-857v-p42q-f3qf | CVE-2026-89105 | 4.2 | SAP Cloud Security library | Improper authentication |
| 3767634 | CVE-2026-58242 | 3.5 | SAP Cloud Connector | Improper authorisation check |
SAP appended three more items to its September page after the September Patch Day, and SecurityBridge counts them towards the October cycle:
| Item | CVE | CVSS | Component | Type |
|---|---|---|---|---|
| 3485073 | CVE-2026-66766 | 7.5 | S/4HANA Manage Supply Protection | DoS, note update |
| 3678417 | CVE-2026-0505 | 6.1 | SAP DMS BSP applications | Multiple flaws, note update |
| 3680888 | CVE-2026-76974 | 5.3 | SAP Fiori Launchpad | Information disclosure, new note |
CVE-2026-89111: a 10.0 in a library that note-based patching never sees
The SAP Cloud SDK for Python is used to build applications on SAP BTP, including multi-tenant ones that serve several tenants from a single deployment. According to the CVE record SAP maintains as the issuing authority, the flaw is a server-side request forgery in the OAuth2 handling: an attacker who controls the tenant_subdomain parameter can redirect the token request to a server of their choosing and walk away with the application’s client credentials. The vector settles the urgency question on its own - network-reachable, no privileges, no user interaction, changed scope, high impact on confidentiality and integrity.
The fix itself is trivial. The trouble is that most SAP patching processes are built around the note: a number, a score, an SNOTE import or a new kernel, a maintenance window. A GitHub advisory has none of these. It is addressed to whoever maintains the application code on SAP BTP and its dependency file, and the tool that catches it is a dependency scanner in the repository, not SAP Solution Manager.
Nor is it a one-off. In July and August 2026 the SAP list carried one GitHub advisory each, both rated medium. October has four, and one of them carries the highest score of the month. Three months do not make a trend, but they are enough to stop treating GitHub advisories as the tail end of the list: this is open-source code inside extension applications, not the ABAP standard.
Last month we wrote that September’s four critical notes had four different owners. October adds a fifth - a team that has never had a reason to read the SAP note list at all.
SAP Note 3797111 - Visual Composer and a safe setting that was off by default
SAP Note 3797111 (CVE-2026-89110, CVSS 9.9) covers SAP NetWeaver Visual Composer, VC70RUNTIME 7.50. A low-privileged user can use portal functionality to invoke internal operations on a preconfigured remote system and, depending on how that connection is set up, end up fully compromising it.
Onapsis Research Labs, who reported the issue, point to a detail that matters more than the patch. The protective setting - an allowlist of data services that may be invoked - already existed, but was not enabled by default. The patch flips that default. The note links to an FAQ (3797831) explaining how to enable the configuration manually before the patch goes in, and SecurityBridge recommends applying that workaround straight away.
SAP Note 3805589 - ABAP code injected through S/4HANA rules
SAP Note 3805589 (CVE-2026-89107, CVSS 9.9) concerns the Manage Substitution/Validation Rules application in SAP S/4HANA (S4CORE 105 to 109). Rules are written in a domain-specific scripting language, and insufficient validation means crafted input is interpreted as executable ABAP. The CVE record describes the outcome as a possible full compromise of the system.
There is one precondition: the attacker needs an account with a specific business role in the related Fiori apps, which the referenced FAQ (3810181) names. The temporary workaround is to deactivate the OData service, and it has an operational price - until the patch is in, nobody can add, change or delete substitution and validation rules. That is a decision for the owner of the finance process, not only for the system administrator.
SAP Note 3798788 - SAP MII with no workaround
SAP Note 3798788 (CVE-2026-89108, CVSS 9.1) applies to SAP Manufacturing Integration and Intelligence 15.4 and 15.5. A user holding the MII administrator role can send a crafted request that creates an administrative account on the underlying Java application server, and take the system from there. There is no workaround. SecurityBridge’s advice is to keep the number of MII administrators to a minimum until the patch is applied.
Three critical notes, one shared precondition: an account
Put the vectors of the three critical SAP Notes side by side and something appears that the 9.9 score hides. Notes 3797111 and 3805589 require low privileges (PR:L); 3798788 requires high privileges (PR:H). None of them is an anonymous attack from the internet. Each one starts with an account that already exists.
That moves the question from “when do we patch” to “who could use this today”. How many accounts hold the role named in the FAQ for 3805589? Who are your MII administrators, and does each of them still need to be? Does Visual Composer have connections to remote systems that nobody remembers setting up? The note list cannot answer any of that. A review of authorisations and configuration can, and a penetration test answers it most completely, because it shows what an account with a given role can actually do in your landscape.
That is why our SAP security reviews and penetration tests cover patch levels together with authorisations, configuration, interfaces and RFC connections, and end with a report, a risk rating, remediation priorities and a retest. We applied the same logic - paths from an ordinary account to critical privileges - when we wrote about SAPMAP, an attack-path mapping tool for SAP.
SAP Note 3765424 - HTTP/2 in the kernel and Web Dispatcher
One of the high-priority notes sits in the layer closest to the network. SAP Note 3765424 (CVE-2026-58249, CVSS 7.5) describes a memory-handling error in the HTTP/2 implementation of the ICM and SAP Web Dispatcher: an unauthenticated request can crash the process. SecurityBridge notes that only installations with HTTP/2 enabled are affected - the default since release 7.73 - that AS Java is out of scope and that a workaround exists. The fix means a new kernel or Web Dispatcher, so it is worth bundling with SAP Note 3626303 (CVSS 7.1), which is also a kernel patch.
Patch Day lasts a month, not a Tuesday
The October count depends on who is counting, and the reason matters. The SAP Support Portal lists 22 items, four of them GitHub advisories. SecurityBridge lists 21 notes: it leaves the GitHub advisories out but adds three items published after the September Patch Day, which SAP appended to its September page - one new note (3680888, SAP Fiori Launchpad) and two updates (3485073 from August and 3678417 from February). SecurityBridge dates all three to 22 September. Onapsis reports 21 new and updated notes.
The practical lesson outweighs the arithmetic. A process that opens the list only on the second Tuesday misses notes and updates published in between, and a process that reads only SAP Notes misses GitHub advisories. In October both gaps contain items rated high or higher.
How SecurityBridge shortens the October cycle
Working through 22 items by hand to establish which of them apply to your landscape is a job that starts from scratch every month. SecurityBridge Patch Management replaces it with a list for your actual systems: according to the vendor, it identifies missing patches across the SAP landscape, analyses their impact and supports automated implementation. In October one more detail counts: whether a note has a workaround and whether implementation involves manual steps. SecurityBridge lists both for every note in its Patch Day analysis. With three notes that have workarounds, that is the difference between being protected today and being protected after the next maintenance window.
The second layer is detection. If three critical notes need an account, it is worth knowing whether anyone tried those paths before the patch went in. That is the job of SecurityBridge Threat Detection, which identifies threats in SAP systems from their security events.
SNOK is a SecurityBridge Premier Partner in Poland, and we implement and run SecurityBridge locally, in Polish and English, in the Central European time zone.
What to do this week
1/ Apply the workarounds for SAP Notes 3797111 (enable the Visual Composer allowlist) and 3805589 (deactivate the OData service, once the finance process owner has agreed), and cut the number of SAP MII administrators to the minimum until 3798788 is in.
2/ Ask your SAP BTP development team whether any application uses the SAP Cloud SDK for Python below 0.45.2. If the answer does not come back straight away, you have two problems: the library and the missing dependency inventory.
3/ Plan a single maintenance window for the kernel and Web Dispatcher covering SAP Notes 3765424 and 3626303.
4/ Decide who receives SAP Notes released between Patch Days and GitHub advisories. If nobody does, that is the most important gap this month.
If the monthly note cycle eats the time your team needs for projects, we can take over SAP Security Patch Day - from analysis and impact assessment to implementation and an audit-ready report. Vulnerability management obligations under NIS2 are covered in our post on NIS2 and SAP, and the free KSC-CHECK assessment shows where your SAP systems stand. The next SAP Security Patch Day falls on Tuesday 10 November 2026. If you would like to talk about your landscape, get in touch.
Sources
- SAP Support Portal, SAP Security Patch Day - October 2026, accessed 13 October 2026
- CVE Program, CVE-2026-89111 record and the records for the remaining items, accessed 13 October 2026
- SecurityBridge, Gert-Jan Koster, SAP Security Patch Day - October 2026, 13 October 2026, accessed 13 October 2026
- Onapsis, SAP Security Notes: October 2026 Patch Day, 13 October 2026, accessed 13 October 2026
Available on request
SAP Cybersecurity from A to Z. A guide for CIOs, CISOs and SAP teams
A SNOK Press book on SAP security: attack paths, authorisations, AI agents as threat and defence, an in-house red team lab, detection and response, NIS2, GDPR, DORA and ISO 27001 - with ready-made checklists and audit templates.
- AI in SAP cuts both ways: SAP Joule and agents are a new attack surface, while AI already helps defenders - the book says what to deploy now and what to wait for.
- An in-house SAP red team lab step by step: from the first test question, through hardware and model choice, to authorisation and the first exercise cycle.
- Ready-made audit tools: a quarterly CIO and CISO checklist with result cards, rules of engagement and test authorisation templates, a mapping to the SAP Secure Operations Map.
Please check your inbox
We have sent a download link to the address provided. It is valid for 7 days.