VulnerabilitiesOct 13, 2026

SAP warns of maximum severity OAuth2 SSRF security flaw

SAP patches maximum-severity OAuth2 SSRF in Cloud SDK for Python; 20 flaws addressed in October update.

Vendor Watch

Run SAP?

Get an email when a reviewed story names SAP, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

Summary

SAP released security updates addressing 20 vulnerabilities across multiple products in October 2026, including CVE-2026-89111, a maximum-severity OAuth2 Server-Side Request Forgery (SSRF) flaw in the Cloud SDK for Python that allows unauthenticated remote attackers to steal credentials by manipulating the tenant_subdomain parameter. The company also patched critical flaws in SAP NetWeaver Visual Composer (CVE-2026-89110) and SAP Manufacturing Integration and Intelligence (CVE-2026-89108). CISA has tracked 14 SAP vulnerabilities as actively exploited since 2021, including three used in ransomware campaigns.

The lesson from this incident

Full lesson

A maximum-severity Server-Side Request Forgery (SSRF) vulnerability in SAP's Cloud SDK for Python allows unauthenticated remote attackers to manipulate the tenant_subdomain parameter to forge requests and steal credentials — requiring zero authentication to exploit. This flaw exemplifies how unvalidated input in authentication-adjacent components can completely undermine identity security controls. The risk is compounded by the fact that CISA has tracked 14 SAP vulnerabilities actively exploited in the wild since 2021, including three tied to ransomware campaigns, demonstrating that SAP environments are high-value, persistent targets. Organizations running SAP Cloud SDK, NetWeaver, or Manufacturing Intelligence platforms must treat October 2026 patches as emergency-priority given the maximum CVSS severity and proven attacker interest.

What helps against this

How we list vendors

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleQualys VMDR Rapid7 Exposure Command (InsightVM)Axonius Exposures all options
External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
For exampleDetectify Surface Monitoring Outpost24 EASM watchTowr Platform all options
Automated patch management
Known holes get closed in days, not months.
For exampleQualys Patch Management Ivanti Neurons for Patch Management NinjaOne Patch Management all options

Indicators of Compromise

cve — CVE-2026-89111
cve — CVE-2026-89110
cve — CVE-2026-89108
cve — CVE-2026-58231
cve — CVE-2026-44756

Entities

SAP (vendor)SAP Cloud SDK for Python (product)SAP Business Technology Platform (BTP) (product)SAP NetWeaver Visual Composer (product)SAP Manufacturing Integration and Intelligence (product)SAP Commerce Cloud (product)