Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE
CybersecurityPriority

SAP fixes a 10/10 flaw in its Cloud SDK for Python in October patches

In its October 13 Patch Day, SAP fixes a critical flaw in the Cloud SDK for Python that could expose OAuth2 secrets, along with three other critical vulnerabilities.

By Frédéric LENQUETTESenior Cybersecurity Consultant at Orange Cyberdefense

2 min read

Translated from French by AI. The original French article is the reference version.

AI-generated illustration

SAP released its monthly security patches on October 13, 2026. The vendor's page lists 22 vulnerabilities, including 20 new ones and 2 updates to earlier notes. The most severe, CVE-2026-89111, receives the maximum score of 10 out of 10. It affects the SAP Cloud SDK for Python, the toolkit used to build applications and AI agents in Python on SAP Business Technology Platform (BTP). No exploitation has been reported so far.

OAuth2 secrets diverted

The flaw is a server-side request forgery (SSRF) affecting multi-tenant BTP applications. According to BleepingComputer, an attacker who controls the tenant_subdomain parameter could redirect OAuth2 token requests to a server they control and harvest the client application's credentials there. The attack is carried out remotely, with no privileges. SAP's table indicates that versions prior to 0.45.2 are affected.

Three other critical flaws

  • CVE-2026-89110 (9.9): an access control flaw in SAP NetWeaver Visual Composer (VC70RUNTIME 7.50). An attacker with limited privileges could fully compromise the system.
  • CVE-2026-89107 (9.9): a code injection in SAP S/4HANA (substitution and validation rules management).
  • CVE-2026-89108 (9.1): a missing authorization check in SAP Manufacturing Integration and Intelligence. An administrator could create an account with extended privileges on the underlying Java application.

High-severity flaws also include an SQL injection in SAP Commerce Cloud (CVE-2026-89113, 8.8) and a memory corruption in the ICM manager of NetWeaver and Web Dispatcher (CVE-2026-58249, 7.5).

Why you shouldn't wait

SAP vulnerabilities appeal to attackers. CISA lists 14 SAP flaws in its catalog of vulnerabilities exploited since November 2021, three of which were used by ransomware. In August, a critical flaw in SAP Commerce Cloud was exploited a few days after the patch was released, according to Defused.

What to do

  • Inventory the Python applications built on BTP with the Cloud SDK, and upgrade to version 0.45.2 or later.
  • In the meantime, compare tenant_subdomain against a list of registered customer subdomains before passing it to the SDK.
  • If an exposed application may have been targeted, rotate its OAuth2 secrets.
  • Apply notes 3797111, 3805589, 3798788 and 3800517 first, then the high-severity notes.

Method: AI-assisted monitoring, verified sources, article reviewed and approved by Frédéric LENQUETTE.

Share this article