CERT-In Advisory
CIAD-2026-0048
Multiple Vulnerabilities in SAP Products
Original Issue Date: October 14, 2026
Severity Rating: Critical
Software Affected
- SAP Cloud SDK for Python versions prior to 0.45.2
- SAP NetWeaver Visual Composer ¿ VC70RUNTIME 7.50
- SAP S/4HANA (Manage Substitution/Validation Rules) ¿ S4CORE versions 105, 106, 107, 108, 109
- SAP Manufacturing Integration and Intelligence (SAP MII) ¿ XMII versions 15.4 and 15.5
- SAP Commerce Cloud ¿ COM_CLOUD version 2211-JDK21
- SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) ¿ HDB 2.00; KRNL64UC 7.53; WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1; CONTSERV 7.53, 7.54; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19, 9.20
- SAP ABAP Platform ¿ KERNEL versions 7.93 and 9.16
- CLA-Assistant versions prior to or equal to 2.13.1
- SAP NetWeaver Application Server for ABAP ¿ SAP_BASIS versions 740, 750, 752, 753, 754, 755, 756, 757, 758, 816, 918
- SAP NetWeaver ABAP Platform ¿ S4CRM versions 100, 200, 204, 205, 206; S4CEXT versions 107, 108; BBPCRM versions 713, 714
- SAP NetWeaver Enterprise Portal ¿ EP-ADMIN 7.50; EP-RUNTIME 7.50
- SAPUI5 (Support Assistant Overlay) ¿ SAP_UI 754
- Yeoman-UI / Application Wizard Extension for Visual Studio Code versions prior to or equal to 1.25.1
- SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) ¿ SAP_BASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816
- SAPUI5 ¿ SAP_UI versions 750, 754, 755, 756, 757, 758, 816; UI_700 version 200
- SAP S/4HANA (Linear Asset Management RAP Business Object) ¿ S4CORE 109
- SAP Global Trade Services, edition for SAP HANA ¿ GTSCORE versions 200 and 300
- SAP Cloud Security Services Integration Library versions 3.6.6 and later, but prior to 4.1.1
- SAP Cloud Connector ¿ SAP_CLOUD_CONNECTOR 2.0
Overview
Multiple vulnerabilities have been reported in SAP products, which could allow an attacker to execute arbitrary code or commands, bypass security controls, gain unauthorized access, disclose sensitive information, manipulate data, or cause denial-of-service conditions on the targeted system.
Target Audience:
All end-user organizations and individuals using SAP Products.
Risk Assessment:
High risk of security restriction bypass, remote code execution, sensitive information disclosure, denial-of-service.
Impact Assessment:
Potential for remote code execution, security restriction bypass, information disclosure and/or denial-of-service.
Description
SAP is an enterprise software provider offering business applications and platforms for enterprise resource planning, application development, data management, manufacturing integration, e-commerce, and cloud services.
Multiple vulnerabilities exist in SAP products due to improper access control, missing authorization checks, server-side request forgery (SSRF), code injection, SQL injection, memory corruption, cross-site scripting (XSS), open redirection, operating system command injection, information disclosure, and improper authentication. An attacker could exploit these vulnerabilities by sending specially crafted requests, providing malicious input, or accessing functions without proper authorization to bypass security controls, execute arbitrary code or commands, access sensitive information, or manipulate data on the targeted system.
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code or commands, gain unauthorized access, disclose sensitive information, manipulate data, or disrupt the availability of the targeted system.
Solution
Apply appropriate updates as mentioned by the vendor:
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html?isu_page=1
Vendor Information
SAP
https://www.sap.com/
References
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html?isu_page=1
CVE Name
CVE-2026-89110
CVE-2026-89107
CVE-2026-89108
CVE-2026-89113
CVE-2026-58249
CVE-2026-89120
CVE-2026-89112
CVE-2026-76972
CVE-2026-24316
CVE-2025-42938
CVE-2026-89117
CVE-2026-76975
CVE-2026-89122
CVE-2026-89116
CVE-2026-76976
CVE-2026-89118
CVE-2026-89121
CVE-2026-89106
CVE-2026-89124
CVE-2025-89105
CVE-2026-58242
CVE-2026-89111
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|