Reported by 3 outlets
SAP Security Patch Day October 2026 fixes four critical vulnerabilities
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 4.50 / 5.0 · CVSS + content signals
- Velocity
- 1.50 / 2.0 · updates in 48h
- Pickup speed
- 0.53 / 0.6 · time to second source
- Recency
- × 0.66 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 6.1 / 10 = base × recency + community
Desk analysis
SAP released its October 2026 Patch Day bulletin on October 13, closing six CVEs with peak CVSS 9.9 and one Cloud SDK flaw at CVSS 10.0. CVE-2026-89107 (9.9) is a scripting injection in S/4HANA that enables full system compromise; CVE-2026-89110 and CVE-2026-89108 (both 9.9) hit Visual Compose, while CVE-2026-58249, CVE-2026-89113, and CVE-2026-89120 fill out the critical tier. The bulletin carries 16 new security notes, four GitHub security advisories, two updates to prior notes, and covers 22 CVEs total. Four of those are rated Critical.
S/4HANA scripting injection is not a remote code execution bug in a peripheral module; it is a direct administrative takeover path in the core ERP platform. Organizations running S/4HANA and NetWeaver face immediate exposure because a single successful injection grants full system compromise, and the 16-note footprint suggests broad surface area across integration and developer libraries. This is not routine maintenance: a CVSS 10.0 Cloud SDK flaw paired with 9.9 scripting and Visual Compose bugs makes this cluster more dangerous than typical quarterly SAP patch days, and defenders should treat it as a priority patch event rather than a routine cycle.
Apply the October 13, 2026 security notes immediately; the bulletin does not list a version-level workaround, so patching is the only reliable remediation. Hunt for S/4HANA scripting injection artifacts in authentication and session logs, review Visual Compose execution telemetry, and inspect Cloud SDK deployments for anomalous initialization or network callbacks. Monitor SAP security note updates for the two revised prior notes, and restrict external access to S/4HANA and NetWeaver management interfaces until patches are confirmed applied.
Watch for vendor confirmation of active exploitation of CVE-2026-89107 or CVE-2026-89110, since the events mention no in-the-wild telemetry yet. A second development that would shift the assessment is SAP releasing an emergency out-of-band note for the CVSS 10.0 Cloud SDK flaw (CVE-2026-58249) or an updated advisory that revises the 9.9 scores upward.
Timeline
-
original reporting
SAP Security Patch Day October 2026 fixes four critical vulnerabilities, including a CVSS 10.0 Cloud SDK flaw and 9.9 bugs in Visual Compose
securityonline.info · 1d ago · October 13th, 2026
SAP Security Patch Day October 2026 fixes four critical vulnerabilities, including a CVSS 10.0 Cloud SDK flaw and 9.9 bugs in Visual Compose
via Mastodon https://securityonline.info/sap-security-patch-day-october-2026/?utm_source=mastodon&utm_medium=jetpack_social
-
update from threataft.com
SAP October Patch Day — 6 CVEs, peak CVSS 9.9. CVE-2026-89107 (9.9): S/4HANA scripting injection → full system compromise CVE-2026-89110 (9.
threataft.com · 21h ago · October 13th, 2026
CVE-2026-89107 (9.9): S/4HANA scripting injection → full system compromise CVE-2026-89110 (9. via Mastodon https://threataft.com/articles/sap-october-2026-cluster-cve-2026-89107-89110-89108-89113-58249-89120
-
update from gbhackers.com
SAP Patches Critical NetWeaver and S/4HANA Security Flaws Affecting Enterprise Systems
gbhackers.com · 14h ago · October 13th, 2026
SAP’s Security Patch Day on October 13, 2026, addresses critical vulnerabilities found in enterprise applications, integration platforms, and developer libraries. The October bulletin details the release, which includes 16 new security notes, four GitHub security advisories, and two updates to previously published notes, covering a total of 22 CVEs. Four vulnerabilities are rated as Critical. […] The post SAP Patches Critical NetWeaver and S/4HANA Security Flaws Affecting Enterprise Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .