SAP Security Notes: October 2026 Patch Day

Critical Patches for S/4HANA, SAP MII, and SAP Visual Composer

Highlights of October SAP Security Notes analysis include:

• October Summary – Twenty-one new and updated SAP security patches released, including three HotNews Notes and four High Priority Notes
• S/4HANA in focus – Critical Code Injection vulnerability can result in full system compromise
• Onapsis Research Labs Contribution – Our team supported SAP in patching ten vulnerabilities covered by eight SAP Security Notes, including two tagged as HotNews and one tagged as High Priority

SAP has published twenty-one new and updated SAP Security Notes in its October Patch Day, including three HotNews Notes and four High Priority Notes. Eight of the seventeen new Security Notes were published in contribution with the Onapsis Research Labs.

The HotNews Notes in Detail

The Onapsis Research Labs (ORL) supported SAP in patching two of the three new HotNews Notes.

SAP Security Note #3797111, tagged with a CVSS score of 9.9, patches a Broken Access Control vulnerability in SAP NetWeaver Visual Composer. The Onapsis Research Labs (ORL) detected that certain portal functionality in Visual Composer allows a low-privileged attacker to invoke internal operations on a preconfigured remote system. A security configuration is available that allows for the definition of an allowlist of permissible data services to be invoked; however, this configuration is not enabled by default. The patch changes the default configuration by enabling the secure settings. The note provides an additional FAQ document and explains how the secure configuration can be enabled manually, prior to the permanent patch. A successful exploit of this vulnerability could lead to a full compromise of the remote system.

SAP Security Note #3805589, tagged with a CVSS score of 9.9, addresses a critical Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) that enables authenticated attackers to execute arbitrary ABAP code on the system. Due to insufficient input validation in the rule definition process, users with a specific business role in the Fiori Applications could submit specially crafted input which is interpreted as executable ABAP code by the rule processing logic. This could lead to a complete compromise of the affected system. Additional information about the affected Fiori apps and the specific role that is required can be found in the referenced FAQ document. As a temporary workaround, the affected OData service can be deactivated. But customers should be aware that deactivating the OData service blocks adding, modifying or deleting existing substitution/validation rules in any related Fiori App.    

SAP Security Note #3798788, tagged with a CVSS score of 9.1, patches a Missing Authorization check vulnerability in SAP Manufacturing Integration and Intelligence (Configuration Service). The vulnerability was detected and reported to SAP by the Onapsis Research Labs. When authenticated as an SAP XMII Admin user with network access to specific endpoints, they could submit a specially crafted request to provision an account with administrative privileges on the underlying Java application server. This account can be used afterwards to fully compromise the system. 

The High Priority Notes in Detail

SAP Security Note #3800517, tagged with a CVSS score of 8.8, describes an SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code). Insufficient validation of user-provided input allows the injection of arbitrary SQL commands through authenticated attackers. The corresponding SAP Commerce Cloud patch introduces correct validation and sanitization for certain input parameters of the affected list APIs before they are used to build search queries. After installing the patch, customers need to rebuild and redeploy the updated SAP Commerce Cloud version. As a temporary workaround, the affected input parameters can be disabled. This eliminates the attack vector but it will also disable the associated sort functionality for the affected endpoints.  

The Onapsis Research Labs(ORL) detected a Memory Corruption vulnerability in SAP NetWeaver ICM and SAP Web Dispatcher that can be exploited to severely negatively affect the availability of the affected application. Due to improper validation of certain fields, an unauthenticated attacker could send malicious requests that trigger a memory-handling error, causing the affected process to crash. SAP Security Note #3765424, tagged with a CVSS score of 7.5, patches the vulnerability for SAP Kernel ABAP, standalone SAP Web Dispatcher, SAP Content Server, and SAP HANA XSC/XSA. Since the issue is caused by a program error in the HTTP/2 implementation, only installations where HTTP/2 is supported and enabled, are affected.  

SAP Security Note #3485073, tagged with a CVSS score of 7.5, was initially released in August 2026 and patches a Denial of Service vulnerability in SAP S/4HANA (Manage Supply Protection). The ‘Symptom’ section of the note was updated.

SAP Security Note #3626303, tagged with a CVSS score of 7.1, patches a Missing Authorization Check vulnerability in SAP ABAP Platform that was reintroduced with an API change. The session manager can be opened in single transaction mode allowing a low-privileged attacker to bypass restrictions via specially crafted requests. This can result in high impact on integrity and low impact on confidentiality. The corresponding kernel patch blocks the unintended access to the Easy Access Menu.  

Onapsis Contribution

The Onapsis Research Labs (ORL) contributed significantly to SAP’s October Patch Day. In addition to two HotNews Notes and one High Priority Note, the ORL supported SAP in patching another seven vulnerabilities covered by five Medium Priority Notes.

The ORL detected two vulnerabilities in SAP Manufacturing Integration and Intelligence (SAP MII) that allow an attacker to store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim’s browser context. Successful exploitation could allow the attacker to access session information, modify rendered page content and disrupt the victim’s use of the application. SAP Security Note #3798823, tagged with a CVSS score of 6.5, provides a list of mitigation steps and operational recommendations to minimize the risk of an attack.

Several vulnerabilities in SAP NetWeaver Enterprise Portal were patched by SAP in collaboration with the ORL team:

• SAP Security Note #3790401, tagged with a CVSS score of 6.1, patches an Open Redirect vulnerability that is caused by insufficient input validation in a certain portal component. This allows an unauthenticated attacker to craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Upon successful exploitation, the attacker can track user information and deface parts of the rendered page.   
• SAP Security Note #3779985, tagged with a CVSS score of 6.1, addresses a Cross-Site Scripting vulnerability in SAP NetWeaver Enterprise Portal. Logged in as an unauthenticated attacker, the ORL team was able to inject malicious scripts into a certain URL parameter. These scripts were reflected in the server response and are executed in a user’s browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection.   
• SAP Security Note #3789825, tagged with a CVSS score of 5.3, blocks two anonymously accessible endpoints that expose information which should not have been publicly accessible. The ORL team identified these two endpoints that could be used by an unauthenticated attacker to access restricted resources and non-critical application information.

SAP Security Note #3794572, tagged with a CVSS score of 6.1, patches a DOM-based Cross-Site Scripting vulnerability in SAPUI5 (Support Assistant Overlay). The vulnerability allows an authenticated attacker to generate a malicious link and make it publicly accessible. If the link is accessed by an authenticated user, client-side code reads the attacker-controlled input and writes it into the DOM without proper sanitization, causing the attacker-supplied script to execute in the victim’s browser context. In this way, the attacker can access or modify information within the victim’s browser scope, impacting confidentiality and integrity.      

Summary & Conclusions

With twenty-one SAP Security Notes, including three HotNews and four High Priority Notes, SAP’s October Patch Day is an average one. With ten vulnerabilities, covered by eight SAP Security Notes, the Onapsis Research Labs could once more significantly contribute to SAP’s Patch Day.

As always, the Onapsis Research Labs is already updating The Onapsis Platform to incorporate the newly published vulnerabilities into the product so that our customers can protect their businesses.

For more information about the latest SAP security issues and our continuous efforts to share knowledge with the security community, subscribe to our monthly Defender’s Monthly Newsletter.