SAP's October 2026 Patch Day targets critical vulnerabilities in NetWeaver, S/4HANA, manufacturing software, and cloud development libraries This article explores vulnerabilities cve 2026. .

The following is a list of affected products and components, along with their affected versions and the associated vulnerabilities: - CVE-2026-89111 SAP Cloud SDK for Python <0.45.2: OAuth2 SSRF - CVE-2026-89110 NetWeaver Visual Composer VC70RUNTIME 7.50: Broken access control - CVE-2026-89107 S/4HANA Manage Substitution/Validation Rules S4CORE 105, 106, 107, 108, 109: Code injection - CVE-2026-89108 Manufacturing Integration and Intelligence Configuration Service XMII 15.4, 15.5: Missing authorization check - CVE-2026-89113 Commerce Cloud OOTB Code COM_CLOUD 2211-JDK21: SQL injection - CVE-2026-58249 NetWeaver and Web Dispatcher Internet Communication Manager HDB 2.00; KRNL64UC 7.53; WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1; CONTSERV 7.53, 7.54; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19, 9.20: Memory corruption - CVE-2026-89120 ABAP Platform KERNEL 7.93, 9.16: Missing authorization check - CVE-2026-89112 CLA-Assistant ≤2.13.1: Broken access control; CLA signature PII disclosure - CVE-2026-76972 Manufacturing Integration and Intelligence XMII 15.4, 15.5: Cross-site scripting - CVE-2026-24316 NetWeaver Application Server for ABAP SAP_BASIS 740, 750, 752, 753, 754, 755, 756, 757, 758, 816, 918: SSRF; updated March 2026 note - CVE-2025-42938 NetWeaver ABAP Platform S4CRM 100, 200, 204, 205, 206; S4CEXT 107, 108; BBPCRM 713, 714: Cross-site scripting; updated September 2025 note - CVE-2026-89117 NetWeaver Enterprise Portal EP-ADMIN 7.50: Cross-site scripting - CVE-2026-76975 SAPUI5 Support Assistant Overlay SAP_UI 754: Cross-site scripting - CVE-2026-89122 NetWeaver Enterprise Portal EP-RUNTIME 7.50: Open redirect - CVE-2026-89116 Yeoman-UI / Application Wizard Extension for VS Code yeoman-ui ≤1.25.1: OS command injection - CVE-2026-76976 NetWeaver Application Server ABAP, SAP GUI for HTML applications SAP_BASIS 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816: Cross-site scripting - CVE-2026-89118 NetWeaver Enterprise Portal EP-RUNTIME 7.50: Information disclosure - CVE-2026-89121 S/4HANA Linear Asset Management RAP Business Object S4CORE 109: Missing authorization check - CVE-2026-89106 SAPUI5 SAP_UI 750, 754, 755, 756, 757, 758, 816; UI_700 200: Cross-site scripting - CVE-2026-89124 Global...