SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
SAP patches critical NetWeaver and S/4HANA vulnerabilities allowing system compromise.
Run SAP?
Get an email when a reviewed story names SAP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
SAP has released 22 security notes, including four critical-severity vulnerabilities affecting NetWeaver, S/4HANA, and Cloud SDK for Python. These flaws, with CVSS scores up to 10/10, could allow attackers to exfiltrate credentials, execute arbitrary code, or fully compromise systems. SAP advises users to update their applications promptly.
The lesson from this incident
Full lessonSAP has disclosed 22 vulnerabilities, including four rated critical with CVSS scores up to 10/10, affecting core enterprise platforms NetWeaver, S/4HANA, and Cloud SDK for Python. These flaws could allow attackers to steal credentials, execute arbitrary code, and achieve full system compromise — representing an existential risk to organizations running unpatched SAP environments. Because SAP systems frequently host sensitive financial, HR, and operational data, exploitation could lead to devastating data breaches or business disruption. The root cause lies in delayed or absent patch application across complex enterprise software landscapes where testing cycles can slow deployment. Organizations must treat critical vendor patches as emergency change requests rather than routine maintenance.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- cve — CVE-2026-89111
- cve — CVE-2026-89110
- cve — CVE-2026-89107
- cve — CVE-2026-89108