SAP released fixes for 20 vulnerabilities in its October patch day, four of them critical. The most severe, a flaw in SAP Cloud SDK for Python, carries the maximum CVSS score of 10.0. SAP reports no exploitation in the wild and no public proof-of-concept code.
CVSS 10.0 Server-Side Request Forgery in SAP Cloud SDK for Python
The top-rated flaw is a server-side request forgery (SSRF) in SAP Cloud SDK for Python, affecting multi-tenant applications on SAP’s Business Technology Platform. An attacker who controls a tenant subdomain value can redirect OAuth2 token requests to a server they run. The redirect lets the attacker exfiltrate client credentials, and the attack requires no login.
The issue is tracked through a GitHub security advisory. SAP rates the flaw at the maximum score because the attack needs no login and the stolen client credentials belong to the application itself.
The exposure depends on how a given application handles the tenant subdomain value. The attack path needs only that value to be attacker-controlled; the attacker does not have to sign in, and the stolen material is the client credentials the application uses when it requests tokens.
Two CVSS 9.9 Bugs in NetWeaver Visual Composer and S/4HANA
Two further critical vulnerabilities are rated 9.9. The first sits in SAP NetWeaver Visual Composer, where portal functions lack authorization checks. A low-privileged attacker could trigger operations on a preconfigured remote system and potentially fully compromise it.
The second affects the Manage Substitution/Validation Rules app in S/4HANA. Crafted input is interpreted as executable ABAP code, which can lead to full system compromise. In both cases the flaws turn limited access into broad control.
The Visual Composer flaw reaches beyond the portal itself. Because the vulnerable functions let an attacker act on a preconfigured remote system, a weakness in one component becomes a way into another system the portal is connected to. The S/4HANA flaw stands out for a different reason: the app’s input handling turns attacker-supplied text into ABAP code that the system then runs, which SAP says can end in full system compromise.
CVE-2026-58249 Lets Unauthenticated Attackers Crash NetWeaver and Web Dispatcher
Among the lower-rated issues, CVE-2026-58249 has a CVSS score of 7.5. An unauthenticated attacker can crash NetWeaver and Web Dispatcher processes by sending a malicious request. The flaw does not give code execution, but it allows disruption of systems that front SAP environments.
Cloud SDK, NetWeaver and S/4HANA Flaws Create Separate Patching Decisions
SAP software runs finance, supply chain and HR functions at large enterprises. The flaws in this month’s release could lead to stolen cloud credentials, code execution and takeover of connected systems, depending on the product. Each of the four critical bugs sits in a different component, so organizations running a mix of BTP applications, NetWeaver and S/4HANA face several separate patching decisions rather than a single update.
SAP has not reported active exploitation, and no public exploit code exists. That leaves a window in which defenders can apply fixes before attackers study the patches.
Patches Are Available, With Release Details Behind SAP Support Login
Patches are available now. The exact affected releases are listed in SAP Security Notes, which require a support login. Customers who do not have the right access should confirm with their SAP administrators which notes apply to their landscape.
For the Cloud SDK for Python flaw, the GitHub advisory gives a public reference alongside the SAP note. Administrators responsible for multi-tenant applications on BTP face the clearest priority, since the attack needs no authentication and the maximum score reflects the exposure of client credentials.
Details of the 15 remaining CVEs, outside the four critical bugs and CVE-2026-58249, appear in SAP’s patch day listing. Because the information about this release comes from a single report, readers should verify the specifics against SAP’s own patch day page before planning remediation.
