SAP’s October patch day landed on Tuesday with four notes rated Critical. Two of them, scored 9.9, let a user with an ordinary login take over an S/4HANA system or a system that the Visual Composer portal connects to.
SAP has not reported any of them as exploited. SAP systems hold finance and payroll data, so the basis team should plan the change this week.
Two of SAP’s October fixes turn an ordinary business login into control of the system. That is worth a basis team change ticket this week.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
SAP ships four critical notes for October
SAP released 16 new security notes and 4 GitHub security advisories, plus two updated notes. The critical ones:
- Note 3805589, CVE-2026-89107 (9.9): code injection in S/4HANA Manage Substitution/Validation Rules. Onapsis says users with a specific business role in the Fiori apps could submit input that runs as ABAP code.
- Note 3797111, CVE-2026-89110 (9.9): broken access control in NetWeaver Visual Composer. Onapsis says a low-privileged user could call internal operations on a preconfigured remote system, because an allowlist setting is off by default. The patch turns it on.
- Note 3798788, CVE-2026-89108 (9.1): missing authorization check in the Manufacturing Integration and Intelligence configuration service.
- CVE-2026-89111 (10.0): server-side request forgery in the SAP Cloud SDK for Python, fixed in version 0.45.2.
S/4HANA finance rules and Visual Composer portals
The S/4HANA bug affects S4CORE 105 through 109. The Visual Composer bug affects VC70RUNTIME 7.50. Onapsis warns it could lead to full compromise of the remote system that Visual Composer reaches, so the risk sits in whatever backends the portal is wired to.
Both need a login, so the people who can exploit them are your own users, contractors, or anyone whose SAP password has been phished.
Book the S/4HANA and Visual Composer notes first
- Apply note 3805589 to S/4HANA. If you cannot patch this week, Onapsis says the affected OData service can be switched off temporarily, but that also blocks rule changes in the related Fiori apps.
- Apply note 3797111 to Visual Composer. Onapsis says the note explains how to turn on the secure configuration by hand before you can patch.
- Check who holds the business role named in note 3805589’s FAQ, and trim it.
- Ask developers whether anything uses the SAP Cloud SDK for Python, and move it to 0.45.2.
Forward this
For our SAP basis team: SAP’s October patch day has two 9.9 fixes, one for S/4HANA validation rules (note 3805589) and one for Visual Composer (note 3797111). Neither is reported exploited, but both let a normal SAP user take control. Can we get both into this week’s change window?
Details
- 3805589 / CVE-2026-89107: S/4HANA Manage Substitution/Validation Rules, code injection, S4CORE 105, 106, 107, 108, 109, CVSS 9.9.
- 3797111 / CVE-2026-89110: NetWeaver Visual Composer, broken access control, VC70RUNTIME 7.50, CVSS 9.9.
- 3798788 / CVE-2026-89108: Manufacturing Integration and Intelligence configuration service, missing authorization, XMII 15.4 and 15.5, CVSS 9.1.
- CVE-2026-89111: SAP Cloud SDK for Python before 0.45.2, OAuth2 SSRF, CVSS 10.0.
- Also: 3765424 / CVE-2026-58249, NetWeaver and Web Dispatcher ICM memory corruption, unauthenticated crash, CVSS 7.5.
Hunt / verify
- Change logs for substitution and validation rules created or edited outside normal finance change tickets.
- Visual Composer data-service calls to backend destinations from users who do not build Visual Composer models.
- Web Dispatcher and ICM process restarts that line up with unusual inbound requests.
Slack paste: SAP Oct patch day: 4 critical. Priority: note 3805589 (S/4HANA validation rules, 9.9) and 3797111 (Visual Composer, 9.9), then MII 3798788 and Cloud SDK for Python 0.45.2. None reported exploited.
Sources
- SAP: Security Patch Day, October 2026
- Onapsis: SAP Security Patch Day for October 2026
- Canadian Centre for Cyber Security: SAP security advisory, October 2026 monthly rollup (AV26-1030)
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
