🚨 SAP SECURITY PATCH DAY: CVSS 10.0 OAUTH2 SSRF (CVE-2026-89111) PLUS 3 OTHER CRITICAL FLAWS SAP released its October 13, 2026 Security Patch Day with 16 new security notes and 4 GitHub advisories (plus 2 updates to prior notes). • CVE-2026-89111 (CVSS 10.0) — OAuth2 SSRF in SAP Cloud SDK for Python (< 0.45.2); attacker-controlled tenant_subdomain can redirect token requests and exfiltrate client credentials. Fixed in 0.45.2; allowlist workaround available • CVE-2026-89110 (CVSS 9.9) — broken access control in SAP NetWeaver Visual Composer (VC70RUNTIME 7.50) • CVE-2026-89107 (CVSS 9.9) — code injection in SAP S/4HANA Manage Substitution/Validation Rules (S4CORE 105–109) • CVE-2026-89108 (CVSS 9.1) — missing authorization check in SAP Manufacturing Integration and Intelligence Configuration Service (XMII 15.4 / 15.5) • Also High: CVE-2026-89113 SQL injection in Commerce Cloud (8.8); CVE-2026-58249 memory corruption in NetWeaver / Web Dispatcher ICM (7.5) ⚠️ Analyst Note: Official SAP Patch Day advisory. Not in the CISA KEV catalog as of catalog 2026.10.08. Vendor does not report in-the-wild exploitation for these notes. Prioritize the four Critical / HotNews items. Primary: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html GHSA (89111): https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2 #DDW #DarkWeb #SAP #CVE #PatchDay #ThreatIntelligence #CyberSecurity