SAP’s October 13 Patch Day includes 16 new security notes, four GitHub security advisories, and two updates to previously released notes. Four new vulnerabilities are rated Critical, affecting SAP Cloud SDK for Python, NetWeaver Visual Composer, S/4HANA substitution and validation rules, and SAP Manufacturing Integration and Intelligence.
Administrators should not sort this release only by CVSS. The practical queue depends on whether the affected component is present, reachable, exposed to untrusted input, and able to reach high-value data or credentials. Begin with an evidence-backed inventory and close each item by verifying the installed component version or SAP Note state.
Start with the four critical items
CVE-2026-89111 is an OAuth2 server-side request forgery vulnerability in SAP Cloud SDK for Python before version 0.45.2. SAP assigns it CVSS 10.0. Teams must find the library in source repositories, build manifests, containers, serverless packages, and deployed Python environments—not only in centrally managed SAP systems.
CVE-2026-89110 is a broken-access-control issue in NetWeaver Visual Composer VC70RUNTIME 7.50 with CVSS 9.9. CVE-2026-89107 is a code-injection vulnerability in the S/4HANA Manage Substitution/Validation Rules function across S4CORE 105 through 109, also rated 9.9. CVE-2026-89108 is a missing-authorization check in the SAP MII Configuration Service for versions 15.4 and 15.5, rated 9.1.
For each, identify public and partner reachability, trusted-user requirements, service accounts, data access, and whether compensating network controls are actually enforced. Critical systems exposed through portals, integration middleware, or reverse proxies should be placed in the first maintenance ring.
Do not overlook high-severity internet-facing components
The SAP October Patch Day bulletin also lists CVE-2026-89113, an SQL injection in SAP Commerce Cloud out-of-the-box code, and CVE-2026-58249, memory corruption affecting SAP NetWeaver and SAP Web Dispatcher Internet Communication Manager components.
Internet-facing Web Dispatcher and ICM exposure can justify moving a high-severity item ahead of a critical flaw on an isolated internal development system. Confirm listening interfaces, reverse-proxy paths, administrative endpoints, and segmentation rather than relying on the application owner’s recollection.
Map code dependencies as well as SAP instances
The Cloud SDK advisory demonstrates why the SAP asset inventory must include software composition data. Search package locks, SBOMs, CI artifacts, containers, and deployment manifests for affected versions. Upgrade to 0.45.2 or later, rebuild artifacts from a trusted pipeline, deploy them, and verify the runtime package version.
Likewise, GitHub advisories in the Patch Day set may affect development tools or libraries rather than traditional SAP servers. Assign them to application and platform teams through the same vulnerability workflow instead of leaving them in a separate developer backlog.
Plan a safe SAP maintenance sequence
Read the complete SAP Note and prerequisites in the support portal before installation. Confirm required support packages, kernel dependencies, manual configuration steps, and whether the note is reversible. Test critical business transactions, integrations, background jobs, printing, identity flows, and custom code in a representative environment.
For clustered or highly available systems, patch in an order that preserves service and prevents an unpatched node from rejoining production. Record the version and note state of each application server, dispatcher, database-facing component, and standby node.
Hunt when the vulnerable path was exposed
Patching removes the known vulnerable behavior but does not prove that it was never abused. For exposed Visual Composer, S/4HANA rule-management, MII configuration, Commerce, or ICM paths, review authentication events, configuration changes, new users, rule changes, unusual requests, process activity, outbound connections, and database access during the exposure window.
Preserve logs before a restart or cleanup. If unauthorized code execution or configuration change cannot be excluded, expand the response to credentials, service accounts, integration secrets, and downstream systems reachable from the SAP component.
Close by product and component
Create a matrix with SAP Note or advisory, CVE, affected product, installed version, reachability, owner, maintenance date, verification evidence, and residual risk. The Patch Day is complete only when every affected instance and code dependency has a disposition: patched, removed, proven not affected, or covered by an approved short-term exception.
SAP’s October release is broad, but the first priorities are clear: patch the four critical paths, move internet-facing ICM and Commerce exposure near the top, and verify the runtime state rather than closing tickets on planned changes.
