CVE-2026-89108

🚨 SAP SECURITY PATCH DAY: CVSS 10.0 OAUTH2 SSRF (CVE-2026-89111) PLUS 3 OTHER CRITICAL FLAWS SAP released its October 13, 2026 Security Patch Day with 16 new security notes and 4 GitHub advisories (plus 2 updates to prior notes). • CVE-2026-89111 (CVSS 10.0) — OAuth2 SSRF in SAP Cloud SDK for Python (< 0.45.2); attacker-controlled tenant_subdomain can redirect token requests and exfiltrate client credentials. Fixed in 0.45.2; allowlist workaround available • CVE-2026-89110 (CVSS 9.9) — broken access control in SAP NetWeaver Visual Composer (VC70RUNTIME 7.50) • CVE-2026-89107 (CVSS 9.9) — code injection in SAP S/4HANA Manage Substitution/Validation Rules (S4CORE 105–109) • CVE-2026-89108 (CVSS 9.1) — missing authorization check in SAP Manufacturing Integration and Intelligence Configuration Service (XMII 15.4 / 15.5) • Also High: CVE-2026-89113 SQL injection in Commerce Cloud (8.8); CVE-2026-58249 memory corruption in NetWeaver / Web Dispatcher ICM (7.5) ⚠️ Analyst Note: Official SAP Patch Day advisory. Not in the CISA KEV catalog as of catalog 2026.10.08. Vendor does not report in-the-wild exploitation for these notes. Prioritize the four Critical / HotNews items. Primary: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html GHSA (89111): https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-4mv3-jxxm-9cx2 #DDW #DarkWeb #SAP #CVE #PatchDay #ThreatIntelligence #CyberSecurity

#NØØT_Security_Alerts 🚨 #ALERT — SAP MANUFACTURING CVSS 9.1: PRIVILEGE ESCALATION ENABLES JAVA APPLICATION SERVER TAKEOVER October 13, 2026 DISCLOSED BY: SAP Security PRODUCT: SAP Manufacturing Integration and Intelligence (MII) — Configuration Service CVE: CVE-2026-89108 SEVERITY: CRITICAL — CVSS 9.1 WEAKNESS: CWE-862 — Missing Authorization AFFECTED VERSIONS: XMII 15.4 and 15.5. IMPACT: Insufficient authorization checks allow an attacker with MII administrator privileges to submit crafted requests that create an account with elevated permissions on the underlying Java application server. Successful exploitation could grant administrative control beyond the MII application. EXPOSURE: Requires existing MII administrator privileges and network access. No user interaction required. NOT an unauthenticated vulnerability. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL PRIVILEGE ESCALATION. No verified in-the-wild exploitation or working public PoC identified. Forensic triage: Audit newly created Java application server administrator accounts. Review unexpected privilege assignments, Configuration Service activity and suspicious MII administrator operations. No verified CVE-specific malicious IOCs published. URGENT ACTION: Apply SAP Security Note 3798788. Restrict MII administrator privileges and management access. Investigate unauthorized Java application server accounts. SOURCE: https://support.sap.com/en/my-support/knowledge-base/security-notes-news/october-2026.html SAP SECURITY NOTE: https://me.sap.com/notes/3798788 CONFIDENCE: HIGH — SAP’s October security bulletin and SAP-authored vulnerability record confirm affected versions, prerequisites and potential administrative takeover. Actual exploitation remains unverified. #CyberSecurity #ThreatIntel #SAP #PrivilegeEscalation #ManufacturingSecurity