SAP has released its October security updates, patching 20 vulnerabilities across its product suite. Among these is a maximum-severity flaw in the SAP Cloud SDK for Python, which could allow attackers to steal credentials, based on information published by Bleeping Computer.
The most critical vulnerability, CVE-2026-89111, affects the SAP Cloud SDK for Python and allows unauthenticated remote attackers to exfiltrate client credentials by redirecting OAuth2 token requests. SAP suggests a temporary mitigation by validating tenant_subdomain values against an allowlist. Other significant patches include a critical broken access control vulnerability in SAP NetWeaver Visual Composer (CVE-2026-89110) and a critical flaw in SAP Manufacturing Integration and Intelligence (CVE-2026-89108) that could lead to full system compromise. These updates come as SAP continues to address high-severity flaws, with the U.S. Cybersecurity and Infrastructure Security Agency adding 14 SAP vulnerabilities to its actively exploited list since November 2021, three of which were linked to ransomware attacks. SAP, a major enterprise software provider, serves a vast majority of the world's largest companies, making these patches crucial for maintaining system security.
Source: Bleeping Computer
