SAP fixed CVE-2026-89111, a maximum-severity OAuth2 SSRF in its Cloud SDK for Python, in a 20-flaw October 2026 update. A multi-tenant BTP app that lets outside input set tenant_subdomain can send its client credentials to an attacker until it is patched or allowlisted.
Perspective Coverage
4 publishers
- Builder
- Builder 24%
- Operator
- Operator 64%
- Investor
- Investor 12%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence78
Unauthenticated SAP attackers hit memory corruption before any login check
Onapsis found CVE-2026-44756 in SAP's Extended Passport code, Pathlock and nullFaktor reproduced remote code execution in a lab, and technical write-ups went public within 48 hours of the patch. Mandiant's AI report is the week's other substance.
Reality
- Evidence58
- Adoption45
- Hype gap+10
- Incentives68
- Confidence50
SAP patches a kernel flaw that lets unauthenticated requests run OS commands as SAP admin
Onapsis, which found the flaw alongside SAP, rates it CVSS 10.0 and recommends immediate patching. A second kernel note in the same batch reaches every S/4HANA 2025 system and any older release already on a current kernel.
Publishers:onapsis.com
Reality
- Evidence55
- Adoption20
- Hype gap+25
- Incentives75
- Confidence48
SAP shipped Security Note 3747649 on September 8 for CVE-2026-44756, a memory corruption bug in Extended Passport processing that Onapsis says gives unauthenticated callers command execution as the account owning the SAP install.
Reality
- Evidence72
- Adoption24
- Hype gap+14
- Incentives68
- Confidence66
buildOne report1 publisher Extended Passport parsing puts SAP's CVSS 10.0 overflow ahead of every logon check
Onapsis says the OVERPASS overflow fires while the SAP kernel processes an Extended Passport at session initiation, which happens before authentication or logon policy is consulted. That leaves reachability and patch state as the only variables.
Reality
- Evidence47
- Adoption
- Not scored
- Hype gap+9
- Incentives62
- Confidence43
Fourteen of SAP's 33 August notes are top-severity: build the named-system list this week
Five HotNews and nine High Priority notes land on Commerce Cloud, NetWeaver AS ABAP and MII, and two of the described fixes are not finished when the patch is applied.
Publishers:onapsis.com
Reality
- Evidence62
- Adoption25
- Hype gap+12
- Incentives72
- Confidence55
buildOne report1 publisher A Commerce Cloud RCE chain reached a honeypot three days after the patch shipped
CVE-2026-58231 chains a default auth client with missing input validation in SAP's Data Hub Adapter. The fix needs a rebuild and redeploy; the attackers needed 72 hours.
Reality
- Evidence42
- Adoption28
- Hype gap+12
- Incentives38
- Confidence44
SAP's CVSS 10.0 Commerce Cloud bug needs a re-deploy, not just a patch window
CVE-2026-58231 lets an unauthenticated attacker reach code execution via the Data Hub Adapter. Onapsis says the fix is patch then re-deploy, with an IP filter set as the stopgap.
Reality
- Evidence70
- Adoption18
- Hype gap+8
- Incentives55
- Confidence62