SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

Key Points:

• SAP has released critical patches addressing four severe vulnerabilities, including CVE-2026-89111, an OAuth2 SSRF vulnerability that could lead to credential exfiltration.
• The vulnerabilities affect SAP's Cloud SDK for Python, NetWeaver Visual Composer, S/4HANA, and Manufacturing Integration and Intelligence, with potential for full system compromise.
• Immediate application updates are recommended to mitigate risks associated with these vulnerabilities.

Technical Details: CVE-2026-89111 allows attackers to redirect OAuth2 token requests by manipulating the tenant_subdomain parameter. CVE-2026-89110 enables low-privileged attackers to invoke internal operations on remote systems. CVE-2026-89107 permits execution of arbitrary ABAP code due to improper input validation. CVE-2026-89108 allows unauthorized account creation by users with XMII Admin privileges.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned: None mentioned