13 October 2026 · RedRays
Two CVSS 9.9 issues lead SAP’s October security release: ABAP code injection through S/4HANA substitution and validation rules, and broken access control in NetWeaver Visual Composer. A third HotNews, rated 9.1, lets an MII administrator cross into administration of the underlying Java application server. All three require authenticated access, but the privileges and systems at risk differ.
Our review of SAP for Me on 13 October found 18 notes with that release date: three HotNews, three High, eleven Medium and one Low. Sixteen appear in the Patch Day category; two are Support Package Security Notes. Of the sixteen Patch Day entries, fourteen are new and two revise earlier advisories. The release-date total should therefore not be reported as eighteen new Patch Day vulnerabilities.
The three HotNews to assess first
S/4HANA — Note 3805589, CVE-2026-89107, CVSS 9.9. The rule-definition functionality can interpret specially crafted input as ABAP code. Exposure requires a business role for an affected Fiori rule-management application. The correction covers S4CORE 105–109. A temporary restriction on the management OData service blocks rule creation, editing and deletion, so Finance needs to be involved before that workaround is applied.
Visual Composer — Note 3797111, CVE-2026-89110, CVSS 9.9. A low-privileged portal user can reach internal operations on configured remote systems. The backend connection’s permissions determine the potential damage. SAP changes a security default and documents Secure Mode as an interim measure, followed by a restart of com.sap.visualcomposer. Include the owners of the connected systems in the exposure review.
SAP MII — Note 3798788, CVE-2026-89108, CVSS 9.1. An MII administrator can exploit a Configuration Service authorization gap to create an account with Java-server administrative privileges. The note covers XMII 15.4 and 15.5. SAP supplies branch-specific patches and explicitly lists no workaround.
High-priority fixes need different deployment plans
Commerce Cloud SQL injection, CVE-2026-89113 (8.8), is corrected in 2211-jdk21.18 or a later patch. An authenticated API session is required. SAP says disclosure applies across supported database engines, while modification and deletion require multi-statement execution support. The deployment is not complete until the corrected application is rebuilt and redeployed.
ICM and Web Dispatcher, CVE-2026-58249 (7.5), can be crashed by an unauthenticated request when HTTP/2 is supported and enabled. Check direct backend listeners as well as the front-end Web Dispatcher. The note includes relevant Content Server and HANA XS deployments and excludes NetWeaver AS Java. Disabling HTTP/2 is SAP’s temporary workaround; activation and restart requirements vary by product.
ABAP Platform, CVE-2026-89120 (7.1), addresses a regression that allows access to the session manager from single-transaction mode, including from Fiori Launchpad. SAP lists kernel 7.93 PL320 and 9.16 PL11 as correction levels and provides no workaround. This is one of the two Support Package Security Notes released on the same date.
All notes released or revised on 13 October
Select a CVE below for our individual analysis. SAP Note links open the original advisory.
| SAP Note | CVE | Issue | CVSS | Release type |
|---|---|---|---|---|
| 3805589 | CVE-2026-89107 | S/4HANA rule-management code injection | 9.9 | Patch Day |
| 3797111 | CVE-2026-89110 | Visual Composer access control | 9.9 | Patch Day |
| 3798788 | CVE-2026-89108 | MII Configuration Service authorization | 9.1 | Patch Day |
| 3800517 | CVE-2026-89113 | Commerce Cloud SQL injection | 8.8 | Patch Day |
| 3765424 | CVE-2026-58249 | ICM / Web Dispatcher HTTP/2 denial of service | 7.5 | Patch Day |
| 3626303 | CVE-2026-89120 | ABAP authorization regression | 7.1 | Support Package |
| 3798823 | CVE-2026-76972 | MII stored XSS | 6.5 | Patch Day |
| 3689080 | CVE-2026-24316 | ABAP test-report SSRF — revised | 6.4 | Patch Day update |
| 3790401 | CVE-2026-89122 | Enterprise Portal open redirect | 6.1 | Patch Day |
| 3794572 | CVE-2026-76975 | SAPUI5 Support Assistant DOM XSS | 6.1 | Patch Day |
| 3779985 | CVE-2026-89117 | Enterprise Portal reflected XSS | 6.1 | Patch Day |
| 3629325 | CVE-2025-42938 | ABAP Platform XSS — revised | 6.1 | Patch Day update |
| 3671819 | CVE-2026-76976 | SAP GUI for HTML XSS | 5.4 | Patch Day |
| 3789825 | CVE-2026-89118 | Enterprise Portal information disclosure | 5.3 | Patch Day |
| 3799621 | CVE-2026-89121 | Linear Asset Management authorization | 4.7 | Support Package |
| 3799054 | CVE-2026-89106 | SAPUI5 URL validation XSS | 4.4 | Patch Day |
| 3810872 | CVE-2026-89124 | GTS product-catalog authorization | 4.3 | Patch Day |
| 3767634 | CVE-2026-58242 | Cloud Connector authorization | 3.5 | Patch Day |
Scores are SAP’s CVSS 3.0 base scores. “Support Package” identifies the two same-day entries outside the Patch Day category. Links in the table open the authoritative SAP Notes.
The quieter changes that can affect operations
The two UI5 notes require attention to the runtime actually loaded by applications. Note 3799054 changes URLListValidator behavior for unspecific allowlist entries; Note 3794572 fixes DOM XSS in Support Assistant Overlay on the 1.71 branch. Both cite 1.71.85 for that branch, but their exposure conditions differ.
SAP GUI for HTML Note 3671819 can stop inline images and other content that relies on newly blocked URI schemes from rendering. Include those pages in regression testing. MII Note 3798823 is a consulting note that calls for controlled dashboard authoring, reviewed transports and CSP configuration; a generic “patch installed” closure does not demonstrate those controls.
Enterprise Portal has separate EP-RUNTIME and EP-ADMIN corrections. Track their component versions independently. The GTS and Linear Asset Management notes address authorization boundaries in business data, so validation should include users who are meant to be denied access as well as users who are meant to retain it.
Two older advisories return
Note 3689080 / CVE-2026-24316 was first released in March 2026. October’s version 16 extends the correction validity for SAP_BASIS 816 to SP00. Reassess systems previously excluded by that validity range.
Note 3629325 / CVE-2025-42938 dates to September 2025. Version 13 changes the solution, validity and correction instructions, with a manual activity for specified S4CEXT levels. Revisit prior closure evidence against the current component table and implementation steps.
Build the work list from deployed components
Start with the three HotNews where the affected functionality is present, then bring unauthenticated HTTP/2 exposure and business-critical Commerce APIs into the same scheduling discussion. Assign each correction to a component owner, record its installed release and patch branch, and identify required rebuilds, restarts or business restrictions before the maintenance window.
Close each item with the running version or correction status and a functional check appropriate to the change. For authorization fixes, include denied-access cases. For consulting guidance, retain configuration and process evidence. A CVSS score helps sort the queue; the exposed service, permitted roles and deployment dependencies determine the actual change plan.
Sources and scope
This review uses the SAP for Me security-note index and the individual SAP Notes linked above, as available on 13 October 2026. It distinguishes SAP’s statements from our operational testing recommendations. It does not claim independent exploit validation or evidence of active exploitation. Use the current SAP Note and its FAQs when selecting a correction for a specific system.
