On October 14, 2026, SAP released 21 security notes as part of its monthly Patch Day, including three HotNews advisories scoring CVSS 9.9 and 9.1 out of 10. Two critical vulnerabilities affect SAP S/4HANA and SAP NetWeaver Visual Composer respectively, while a third targets SAP Manufacturing Integration and Intelligence (MII). Onapsis Research Labs contributed to identifying 10 of the 21 vulnerabilities addressed this cycle (All About Security, October 14, 2026).
Context: A Monthly Patch Cycle That Tolerates No Delay
SAP Patch Day falls on the second Tuesday of each month. For organisations running SAP S/4HANA, SAP ERP, or SAP NetWeaver, SAP’s security team recommends applying HotNews (CVSS score ≥ 9.0) within 72 hours of publication. In practice, most organisations align a monthly maintenance window to this calendar.
October 2026’s cycle is unusually dense: 21 advisories in total, including 3 HotNews and 4 high-priority notes. Onapsis Research Labs — which practices responsible disclosure in coordination with the SAP Product Security Response Team — contributed to 10 of those 21 fixes, covering SAP MII, NetWeaver Enterprise Portal, and the ABAP platform (All About Security, October 14, 2026).
The Three Vulnerabilities in Detail
CVE-2026-89107 (SAP Note #3805589, CVSS 9.9): Code Injection in SAP S/4HANA
The most critical flaw in this cycle affects SAP Fiori applications for managing substitution and validation rules in SAP S/4HANA. An authenticated user holding a specific business role can execute arbitrary code on the host system. The 9.9 CVSS score reflects both the systemic impact and the relative ease of exploitation for anyone who already holds application access (ibid.).
CVE-2026-89110 (SAP Note #3797111, CVSS 9.9): Broken Access Control in SAP NetWeaver Visual Composer
Insufficient access restrictions on NetWeaver Visual Composer portal functions allow an attacker to fully compromise preconfigured remote systems. This type of vulnerability is especially concerning in architectures where NetWeaver acts as the integration layer between an ERP system and third-party applications exposed on the corporate network (ibid.).
CVE-2026-89108 (SAP Note #3798788, CVSS 9.1): Privilege Escalation in SAP MII
A flaw in the Configuration Service of SAP Manufacturing Integration and Intelligence (MII) allows an attacker to create an administrator account on the Java application server. In connected factory environments where SAP MII orchestrates flows between the ERP and production systems (SCADA, MES), this privilege escalation can open direct access to the production floor (ibid.).
Organisational Impact: Three Reasons to Treat These Patches as Emergencies
A CVSS score of 9.9 is not a statistical outlier. The CVSS scale runs from 0 to 10. A score of 9.9 is near-maximum and signals a combination of aggravating factors: high exploitability combined with confidentiality, integrity, and availability impacts all rated at the most severe level. For CVE-2026-89107, authenticated access is the only prerequisite — meaning a compromised account or a malicious insider is all that is needed to trigger arbitrary code execution on the system.
The ongoing migration to S/4HANA amplifies the attack surface. SAP ECC mainstream maintenance ends in 2027. Many organisations currently operate a hybrid landscape: legacy ECC instances in production alongside S/4HANA environments for testing or new business units. This coexistence multiplies the attack surface, particularly because inter-system interfaces are often configured with broad permissions to facilitate migration work.
NetWeaver Visual Composer: a component frequently overlooked in security reviews. Unlike SAP functional modules, Visual Composer is a technical layer that receives little attention from business teams. Yet it is deployed across many NetWeaver AS Java environments. Its position as an intermediary between the ERP and remote systems makes it an attractive lateral movement vector for an attacker who has already established an initial foothold.
What to Monitor Now
SAP recommends immediate application of the three security notes: #3805589, #3797111, and #3798788. Security teams should verify whether the affected components are active in their landscape: SAP S/4HANA with Fiori enabled, SAP NetWeaver AS Java with Visual Composer deployed, and SAP MII regardless of version. The next SAP Patch Day is scheduled for November 10, 2026. Until then, the 4 high-priority notes from this cycle — including an SQL injection in SAP Commerce Cloud (CVSS 8.8) and a memory corruption issue in NetWeaver/Web Dispatcher (CVSS 7.5) — should also be scheduled for the next maintenance window.
To go further on securing your ERP systems, read our complete ERP cybersecurity guide 2026. To understand how a security incident can disrupt an entire digital supply chain, see our analysis of the AIFE e-invoicing platform security breach in October 2026. If your organisation is currently running a SAP migration, our SAP license audit preparation guide provides concrete guidance on managing contractual risk alongside security risk.
