SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
Enterprise software maker SAP on Tuesday announced the release of 22 new and updated security notes, including four that address critical-severity vulnerabilities.
At the top of the list is CVE-2026-89111 (CVSS score of 10/10), an OAuth2 SSRF vulnerability in Cloud SDK for Python that impacts multi-tenant BTP applications.
“An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated,” SAP explains in a GitHub advisory.
Next in line is CVE-2026-89110 (CVSS score of 9.9/10), a broken access control in NetWeaver that could allow authenticated attackers to execute arbitrary ABAP code on the system.
The security defect exists because the rule definition process fails to properly validate input, allowing attackers holding a specific business role in the Fiori Applications to submit crafted input.
Successful exploitation could allow attackers to take over a vulnerable system, enterprise application security firm Onapsis explains...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
