Four SAP Flaws Cross Different Boundaries
SAP’s 13 October release contains four critical entries among 16 new security notes, four GitHub advisories and two updates to older notes. These are release categories, not a unique-vulnerability total. A single estate-wide completion ticket would conceal very different prerequisites.
Cloud SDK credentials
CVE-2026-89111 affects SAP Cloud SDK for Python below 0.45.2 in multi-tenant BTP applications. Control of tenant_subdomain can divert OAuth2 token requests to an attacker’s server and expose client credentials. The 10.0 score records a network path needing neither privileges nor user interaction.
SAP’s public advisory identifies 0.45.2 as the fix, adding DNS-label validation. Its temporary workaround is an allowlist of registered tenant subdomains before SDK calls. This is not a claim that every BTP application is vulnerable.
For a proposed change review, ask the application owner for the running dependency, not just the build configuration. If a temporary control is used, record who accepts it and when it will be replaced.
Visual Composer reaches a remote system
CVE-2026-89110 affects VC70RUNTIME 7.50. Low-privileged portal access can invoke internal operations on a preconfigured remote system; the connection’s configuration determines whether that system can be fully compromised. SAP assigns 9.9 and references Security Note 3797111.
The operational question is therefore larger than whether NetWeaver appears in an inventory. Establish the affected runtime’s presence and map its configured destinations. An administrator reviewing the change needs to know which downstream owner can confirm the result, rather than assuming one application team’s sign-off covers every connection.
S/4HANA turns rule input into code
CVE-2026-89107 affects S4CORE 105 through 109 in Manage Substitution/Validation Rules. An authenticated attacker needs specific business privileges: crafted rule input can execute as ABAP, potentially compromising the system. The score is 9.9; the associated Security Note is 3805589.
This makes rule authorship a consequential access decision. Pair the applicable fix with a review of who can change rules, remove unnecessary access and test representative substitution and validation behaviour. The privilege prerequisite narrows the path without making its potential impact small.
MII administration reaches the Java layer
CVE-2026-89108 affects XMII 15.4 and 15.5. An MII administrator can use a crafted request to create an elevated account on the underlying Java application server, extending control beyond the application. SAP scores it 9.1 and references Security Note 3798788.
Verification should include the Java-layer account state as well as MII administrator assignments. An unexplained privileged account raises a separate investigation question; it is not evidence that applying a patch has established a clean system.
Do not confuse a patch decision with an incident verdict
The public release page names no victims and reports no active exploitation. It also supplies no restart, downtime or fixed-build instructions for the three note-based issues. Retrieve the applicable note through authorised access and use the organisation’s own approval and testing controls; vendor instructions are not deployment authority.
Critical severity describes potential consequences, not an observed attacker. BlackTree’s proposed handover is one accountable record per affected component: the owner, the applicable instruction, the observed running state and the person accepting that evidence. A completed calendar event cannot answer those questions on its own.
Public CNA records: Visual Composer, S/4HANA and MII.
