SAP Patches Maximum-Severity OAuth2 SSRF Flaw in Cloud SDK

SAP has released its October 2026 security updates, addressing 20 security flaws across various products. The updates include a maximum-severity vulnerability in the Cloud SDK for Python, an official toolkit used for developing AI agents and Python applications on SAP Business Technology Platform (BTP) services.

Tracked as CVE-2026-89111, the vulnerability is an OAuth2 Server-Side Request Forgery (SSRF) flaw that affects multi-tenant BTP applications. It can be exploited by remote attackers without privileges, potentially leading to the theft of client credentials.

According to SAP’s advisory, an attacker controlling the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing sensitive client credentials to be exfiltrated. Customers unable to immediately deploy the October 2026 SAP patches can mitigate the issue temporarily by using an allowlist to validate tenant_subdomain values before passing them to any SDK call.

Critical Flaws in NetWeaver and Manufacturing Integration

In addition to the Cloud SDK vulnerability, SAP’s October updates address two other critical flaws. CVE-2026-89110 is a broken access control vulnerability in SAP NetWeaver Visual Composer. This flaw could enable remote attackers with limited privileges to fully compromise vulnerable systems.

Another critical vulnerability, CVE-2026-89108, impacts SAP Manufacturing Integration and Intelligence. Threat actors with administrator privileges could exploit this flaw to gain full administrative control over the underlying system by provisioning an elevated-privilege account on the underlying Java application.

Ongoing Exploitation of SAP Vulnerabilities

SAP has recently patched several other maximum-severity flaws, some of which have seen active exploitation. In August, SAP addressed CVE-2026-58231 in its Commerce Cloud cloud-based e-commerce platform. Threat intelligence firm Defused reported active exploitation of this flaw just days after it was patched.

More recently, in September, SAP fixed the CVE-2026-44756 memory corruption flaw in the SAP Kernel code. This vulnerability, dubbed ‘OVERPASS’ by Onapsis security researchers who reported it, was estimated at the time to expose over 10,000 internet-facing SAP systems to potential attacks.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has previously added 14 SAP security flaws to its Known Exploited Vulnerabilities (KEV) catalogue since November 2021. Three of these vulnerabilities were known to have been abused in ransomware attacks.

SAP, a German multinational software company, provides services to 99 of the 100 largest companies worldwide and reported revenues exceeding €36 billion in fiscal year 2025.