SAP Patches Maximum Severity OAuth2 SSRF in Cloud SDK for Python (CVE-2026-89111)

Scope: SAP Cloud SDK for Python, multi-tenant SAP BTP applications

Severity: Red

SAP addressed 20 security flaws in its October 2026 updates, the most severe being CVE-2026-89111, a maximum severity OAuth2 server-side request forgery vulnerability in the Cloud SDK for Python that a remote attacker can exploit with no privileges at all to steal credentials from multi-tenant BTP applications. SAP also patched CVE-2026-89110, a critical broken access control flaw in NetWeaver Visual Composer that lets a remote attacker with limited privileges fully compromise a vulnerable system, and CVE-2026-89108, a critical issue in SAP Manufacturing Integration and Intelligence that lets an attacker with existing admin privileges provision an elevated-privilege account on the underlying Java application. CISA has added 14 SAP security flaws to its exploited vulnerabilities catalog since 2021, three of them used in ransomware attacks, so SAP’s own advisories are not ones to deprioritise. Organisations running affected SAP products should apply October’s patches immediately; where that is not possible right away for the Cloud SDK flaw, SAP recommends validating tenant_subdomain values against a known allowlist of registered tenants before passing them to any SDK call, as an interim mitigation.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.