SAP week 42 2026: four critical flaws stand out among 20 CVEs

The release at a glance

SAP's security release for week 42 of 2026, covering 12 to 18 October, lists 20 CVEs across the SAP estate. Four are rated critical, three high, twelve medium and one low. The release touches NetWeaver Enterprise Portal, NetWeaver Visual Composer, SAP S/4HANA, Commerce Cloud, Manufacturing Integration and Intelligence, SAP Cloud SDK, SAP ABAP Platform, SAPUI5 and several smaller components. No CVE in this week's set appears in CISA KEV. CVE-2026-89111 has its own advisory page on this site.

What matters most

CVE-2026-89111 in SAP Cloud SDK for Python is the highest-scored item at 10.0. It is an OAuth2 SSRF in multi-tenant SAP BTP applications; by controlling tenant_subdomain, an attacker can redirect OAuth2 token requests to an attacker-controlled server and exfiltrate client credentials. The vector requires no privileges or user interaction, and no fixed version is listed in the public advisory data.

CVE-2026-89107 in SAP S/4HANA Manage Substitution/Validation Rules is a code injection issue with CVSS 9.9. An authenticated attacker with specific business privileges can submit input that the rule-processing logic treats as executable ABAP code; the advisory describes high impact on confidentiality, integrity and availability. Affected versions are S4CORE 105, 106, 107, 108 and 109.

CVE-2026-89110 in SAP NetWeaver Visual Composer (VC70RUNTIME 7.50) is a broken access control issue also rated 9.9. A low-privileged user can invoke internal operations on a preconfigured remote system, which depending on the remote connection configuration could compromise that system.

CVE-2026-89108 in SAP Manufacturing Integration and Intelligence Configuration Service (XMII 15.4 and 15.5) carries CVSS 9.1. It is a missing authorization check: an MII administrator can request an account with elevated privileges on the underlying Java application server, extending the impact beyond the application.

CVE-2026-89113 in SAP Commerce Cloud (COM_CLOUD 2211-JDK21) is a high-severity SQL injection at 8.8. An authenticated user can inject SQL commands and read, modify or delete database data.

CVE-2026-58249 in SAP NetWeaver and SAP Web Dispatcher Internet Communication Manager is a high-severity memory corruption flaw at 7.5. It is reachable without authentication and can crash the affected process. Affected versions include HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16 and XS_ADVANCED_RUNTIME 1.00.

CVE-2026-89120 in SAP ABAP Platform (KERNEL 7.93 and 9.16) is a high-severity missing authorization check at 7.1 triggered by an API regression; a low-privileged attacker can bypass restrictions and gain high integrity impact and low confidentiality impact.

Patch in this order

Priority order for this week:

1. Start with the network-reachable, pre-authentication issues: CVE-2026-89111 (SAP Cloud SDK, CVSS 10) and CVE-2026-58249 (NetWeaver/Web Dispatcher ICM, CVSS 7.5). Both can be triggered without credentials. The public advisory data does not list fixed versions, so restrict network exposure and monitor SAP's advisory updates.
2. Then move to the critical authenticated issues with broad impact: CVE-2026-89107 (S/4HANA Manage Substitution/Validation Rules), CVE-2026-89110 (NetWeaver Visual Composer) and CVE-2026-89108 (MII Configuration Service).
3. Address the high-severity database and platform items next: CVE-2026-89113 (Commerce Cloud SQL injection) and CVE-2026-89120 (ABAP Platform missing authorization).
4. Finally, remediate the medium and low items - including the NetWeaver Enterprise Portal XSS and open redirect, SAPUI5 XSS, MII XSS, CLA-Assistant broken access control, and yeoman-ui - according to normal change windows.

No CVE in this release is in CISA KEV, so no CISA KEV due date applies.

Beyond the patch

For a week with no active exploitation, the decision problem is sequencing: which SAP systems are reachable without credentials and which business processes they feed. SAP HANA Security & Cloud Migration keeps the SAP estate mapped and migration-ready, while Virtual CISO Services (vCISO) helps prioritise exposure decisions for pre-authentication paths like CVE-2026-89111 and CVE-2026-58249.