SAP Security Notes Summary – October 2026
Below you will find the SAP Security Notes for October 2026, including SAP components, note numbers, titles, CVSS scores and release dates.
Review the notes relevant to your SAP landscape and check the affected versions, prerequisites and implementation instructions before applying the corrections.
| SAP Component | Number | Title | CVSS Score | Released On |
|---|---|---|---|---|
| BC-FES-CTL | 3671819 | [CVE-2026-76976] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) | 5,4 | 19.10.2026 |
| FI-SL-VSR | 3805589 | [CVE-2026-89107] Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) | 9,9 | 19.10.2026 |
| CA-UI5-COR | 3799054 | [CVE-2026-89106] Cross Site Scripting (XSS) vulnerability in SAPUI5 | 4,4 | 13.10.2026 |
| EP-PIN-NAV | 3790401 | [CVE-2026-89122] Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal | 6,1 | 13.10.2026 |
| BC-MID-SCC | 3767634 | [CVE-2026-58242] Improper Authorization check in SAP Cloud Connector | 3,5 | 13.10.2026 |
| FT-LEG-CUS-MDT | 3810872 | [CVE-2026-89124] Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration) | 4,3 | 13.10.2026 |
| CEC-SCC-PLA-PL | 3800517 | [CVE-2026-89113] SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) | 8,8 | 13.10.2026 |
| PM-LAM | 3799621 | [CVE-2026-89121] Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) | 4,7 | 13.10.2026 |
| MFG-MII | 3798823 | [CVE-2026-76972] Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence | 6,5 | 13.10.2026 |
| MFG-MII | 3798788 | [CVE-2026-89108] Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) | 9,1 | 13.10.2026 |
| EP-VC-RTM | 3797111 | [CVE-2026-89110] Broken Access Control in SAP NetWeaver Visual Composer | 9,9 | 13.10.2026 |
| BC-CST-IC | 3765424 | [CVE-2026-58249 ] Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) | 7,5 | 13.10.2026 |
| CA-UI5-CTR-ROD | 3794572 | [CVE-2026-76975] Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) | 6,1 | 13.10.2026 |
| BC-TWB-TST-ECA | 3689080 | [CVE-2026-24316] Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP | 6,4 | 13.10.2026 |
| EP-PIN-CS | 3789825 | [CVE-2026-89118] Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal | 5,3 | 13.10.2026 |
| EP-PIN-URL | 3779985 | [CVE-2026-89117] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal | 6,1 | 13.10.2026 |
| CRM-BF-ML | 3629325 | [CVE-2025-42938] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform | 6,1 | 13.10.2026 |
| BC-ABA-SC | 3626303 | [CVE-2026-89120] Missing authorization check in SAP ABAP Platform | 7,1 | 13.10.2026 |
CVSS (Common Vulnerability Scoring System) expresses the severity of a vulnerability as a numerical score. Use it alongside the affected products and your environment when prioritizing security corrections.
Source: SAP for Me – Security Notes. Access to the full notes requires an SAP login.
Previous summary: September 2026.