Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

SAP security patch release for CVE-2026-89111

Security Patch Release
First reported
Last updated
Happening score
H score 38
1 unique sources, 1 articles

Summary

Hide ▲

SAP's October 2026 security updates patch CVE-2026-89111 in SAP Cloud SDK for Python, closing a maximum-severity OAuth2 SSRF flaw. The issue affects multi-tenant BTP applications and could let remote attackers without privileges steal client credentials. SAP says customers that cannot patch immediately can temporarily validate `tenant_subdomain` values with an allowlist. The same update cycle also fixes additional flaws across other SAP products.

Related Happenings

SAP NetWeaver Visual Composer security update (CVE-2026-89110)

Security Patch Release
H score33 First: 13.10.2026 16:51 Last: 13.10.2026 16:51 Sources 1

How related: Today, SAP also addressed CVE-2026-89110, a critical broken access control vulnerability in the SAP NetWeaver Visual Composer that could let remote attackers with limited privileges fully compromise vulnerable systems.

About this happening: SAP's October 2026 security updates patched CVE-2026-89110 in SAP NetWeaver Visual Composer, closing a broken access control flaw that could let remote attackers...

Open Happening

SAP Manufacturing Integration and Intelligence CVE-2026-89108 patch release

Security Patch Release
H score22 First: 13.10.2026 16:51 Last: 13.10.2026 16:51 Sources 1

How related: Another critical flaw patched today in SAP Manufacturing Integration and Intelligence (tracked as CVE-2026-89108) lets threat actors with administrator privileges gain admin control over the underlying system by provisioning an elevated-privilege account on the underlying Java app.

About this happening: SAP's October 2026 security updates now patch CVE-2026-89108 in SAP Manufacturing Integration and Intelligence, closing a flaw that could let an attacker with admini...

Open Happening

SAP security patch release for CVE-2026-44756

Security Patch Release
H score45 First: 09.09.2026 09:25 Last: 09.09.2026 09:25 Sources 1

About this happening: SAP released security updates for multiple critical vulnerabilities, including CVE-2026-44756, a CVSS 10.0 flaw in SAP Extended Passport (EPP) Processing t...

Open Happening

SAP Commerce Cloud (Data Hub Adapter) CVE-2026-58231 patch release

Security Patch Release
H score44 First: 12.08.2026 10:31 Last: 12.08.2026 10:31 Sources 1

About this happening: SAP Commerce Cloud (Data Hub Adapter) CVE-2026-58231 is a maximum-severity CVSS 10.0 vulnerability that can let an unauthenticated attacker abuse a default authent...

Open Happening

SAP security patch release for CVE-2026-44747

Security Patch Release
H score40 First: 14.07.2026 21:17 Last: 14.07.2026 21:17 Sources 1

About this happening: SAP's July 2026 security updates now cover multiple vulnerabilities, including a critical SAP NetWeaver Application Server ABAP flaw. The bundle includes CVE-2026-44...

Open Happening

Timeline

  1. 13.10.2026 16:51 2 articles · 3h ago

    SAP patches CVE-2026-89111 in Cloud SDK for Python and advises an allowlist workaround

    Mitigation Patch Update

    SAP's October 2026 security updates address 20 flaws across multiple products, including CVE-2026-89111 in the SAP Cloud SDK for Python. The maximum-severity OAuth2 SSRF affects multi-tenant BTP applications and can let remote attackers without privileges redirect token requests to an attacker-controlled server and steal client credentials. Customers that cannot deploy the patch immediately can mitigate the issue by validating tenant_subdomain values against a known allowlist before SDK calls.

    Show sources
    Open in new tab