TL;DR: SAP released 16 new security notes and 4 GitHub security advisories, plus 2 updates to earlier notes. Four are rated Critical. (SAP)
| Note | CVE | Product / versions | CVSS | Source |
|---|---|---|---|---|
| GHSA-4mv3-jxxm-9cx2 | CVE-2026-89111 OAuth2 SSRF | SAP Cloud SDK for Python < 0.45.2 | 10.0 | SAP |
| 3797111 | CVE-2026-89110 Broken access control | NetWeaver Visual Composer VC70RUNTIME 7.50 | 9.9 | SAP |
| 3805589 | CVE-2026-89107 Code injection | S/4HANA Manage Substitution/Validation Rules, S4CORE 105–109 | 9.9 | SAP |
| 3798788 | CVE-2026-89108 Missing authorization | MII Configuration Service, XMII 15.4, 15.5 | 9.1 | SAP |
- Fixed versions: delivered through the SAP Notes (customer login required). The Cloud SDK fix is ≥ 0.45.2. (SAP)
- KEV: none of these CVEs is in KEV as of 2026-10-15. (KEV)
Press: SecurityWeek covered the four critical CVEs and says SAP makes no mention of in-the-wild exploitation. (SecurityWeek)
Post-install impact
No confirmed breakage found. The SAP Notes themselves (login-gated) weren't reviewed.
Last verified 2026-10-15Report an error: contact@moonsec.ai