SAP patches four critical flaws, one rated a perfect 10.0
The most severe, CVE-2026-89111, hits SAP's Python SDK before version 0.45.2. Three more affect enterprise products.
SAP fixed four critical vulnerabilities in its October Patch Day, on the 13th, according to SAP's security bulletin. The most severe is CVE-2026-89111, rated 10.0 on the CVSS scale, the top of the system that measures how serious a flaw is.
That flaw sits in SAP Cloud SDK for Python, a library for developers, in versions before 0.45.2. The fix is to update to 0.45.2 or later, according to About InfoSec, which rounded up the four notes on Oct. 18. The other three affect enterprise products.
| CVE | Product | Affected version | CVSS | Fix |
|---|---|---|---|---|
| CVE-2026-89111 | Cloud SDK for Python | before 0.45.2 | 10.0 | Version 0.45.2 or later |
| CVE-2026-89110 | NetWeaver Visual Composer | VC70RUNTIME 7.50 | 9.9 | SAP Note 3805589 |
| CVE-2026-89107 | S/4HANA, substitution and validation rules | S4CORE 105 to 109 | 9.9 | SAP Note 3798788 |
| CVE-2026-89108 | Manufacturing Integration and Intelligence | XMII 15.4 and 15.5 | 9.1 | SAP Note 3800517 |
The Python library is the most direct fix, because it only requires installing the new version of the package. For the other three, administrators have to check whether their versions match the affected ones and apply the matching note. The bulletin does not give the fixed version number for each product, so that detail has to be looked up in each note, which requires access to SAP's support portal.
The sources consulted report no active exploitation of any of the four flaws, and this article does not describe how they could be exploited. SAP did not issue a statement separate from the bulletin.
