SAP Patches a Top-Severity Flaw in Its Python Developer Library
SAP released 16 new security notes and four GitHub security advisories on its October patch day, Oct. 13, 2026, and the highest-rated item on the list is not in its business software but in a developer library.
That item, CVE-2026-89111, is a server-side request forgery vulnerability in the SAP Cloud SDK for Python, and it affects versions before 0.45.2. The company's patch day page lists it as a library rather than a product, which narrows who has to act: the upgrade is for developers whose own Python code is built on that kit, not for administrators of an SAP installation. SAP says it strongly recommends that customers visit its support portal and apply patches as a priority.
SAP rates the flaw 10.0 on CVSS, the industry's severity scale. That is the top of the scale, and it is a judgment of how damaging a flaw could be rather than a report of harm done. Nothing on SAP's page says this vulnerability, or any other on the list, has been exploited.
Three further notes are rated critical. Two are access control failures, in SAP NetWeaver Visual Composer and in a configuration service of SAP Manufacturing Integration and Intelligence; the third is a code injection flaw in S/4HANA's substitution and validation rules. All three are products rather than libraries, with the affected releases listed for each.
The rest of the list is rated high, medium or low. It reaches SAP Commerce Cloud, NetWeaver, SAPUI5 and the SAP Cloud Connector, among others. Two entries are not new: they are updates to notes from earlier patch days.
