Executive Summary
This October review covers 21 SAP Security Notes: three Critical, four High, thirteen Medium and one Low. The priorities are clear: prevent arbitrary ABAP code execution through S/4HANA rule management, close the Visual Composer access-control gap into connected systems, and stop MII administrators from escalating to Java application server administrators.
18 notes are dated 13 October 2026, comprising three Critical, three High, eleven Medium and one Low. Three additional notes carry a 22 September 2026 release date: one High and two Medium. They are covered separately below, rather than counted as October-dated releases. Each unique SAP Note ID is counted once.
The high-severity issues also deserve early attention. They include authenticated SQL injection in SAP Commerce Cloud, an unauthenticated HTTP/2 denial-of-service vulnerability in SAP NetWeaver and Web Dispatcher, and an ABAP Platform regression that reintroduces an authorization weakness. These require different remediation paths: Commerce patching and redeployment, component-specific infrastructure updates, and kernel corrections.
Key Takeaways
Prioritize the two CVSS 9.9 notes immediately. Note 3805589 turns access to specific S/4HANA rule-management business functions into a potential ABAP code-execution path. Note 3797111 allows low-privileged Visual Composer users to invoke operations on preconfigured remote systems, with the ultimate impact depending on the connection configuration. Neither should be treated as an ordinary application-permissions issue.
Do not dismiss the MII issue because it requires an administrator. Note 3798788 crosses the boundary between MII application administration and administration of the underlying Java application server. SAP provides no workaround. The distinction between those two administrative roles is precisely what this correction protects.
Prioritize availability by exposure, not only by score. Note 3765424 requires neither authentication nor user interaction. Where affected HTTP/2 services are reachable from untrusted networks, its CVSS 7.5 rating should not push it behind less-exposed issues automatically. SAP provides a temporary HTTP/2-disabling procedure while permanent corrections are deployed.
Validate the effective result of every change. Visual Composer’s workaround requires an application restart; Commerce Cloud requires rebuilding and redeploying; MII dashboard protections require explicit administrative controls; and browser-related fixes can change legitimate content rendering. A successful import or installation is not the same as a completed security change.
Critical and High-Priority Security Notes
SAP Security Note 3805589 (CVE-2026-89107) – Code Injection in SAP S/4HANA Manage Substitution/Validation Rules
Severity: Critical | CVSS: 9.9
Component scope: S4CORE 105-109.
Exposure profile: Authenticated attacker with a specific rule-management business role; no user interaction required.
Affected Environments and Exposure
The relevant scope is S/4HANA environments using the affected substitution/validation rule functionality. SAP requires the attacker to hold at least one specific business role in the associated Fiori applications. The attack does not require a general system-administrator role.
Nature of the Vulnerability
Root issue: Rule definitions use a domain-specific scripting language, but input is not sufficiently validated. Crafted input can be interpreted as executable ABAP code by the rule-processing logic. SAP describes the potential result as full compromise of the affected system, with high confidentiality, integrity and availability impact.
Attack Scenarios
An attacker with the required business-role access submits a malicious rule definition. The vulnerable processing logic treats that input as executable code rather than restricting it to the intended rule language. The resulting risk extends beyond unauthorized changes to an individual substitution or validation rule.
Business Impact
For organizations using these functions for journal-entry rules, the potential consequence is compromise of the system that processes those rules. The temporary mitigation also has a business cost, because it prevents users from adding, changing or deleting rules through the related Fiori applications.
Mitigation and Recommendations
Patch guidance: Implement Note 3805589 through its correction instructions or referenced support packages. SAP states that the correction does not affect existing substitution/validation rules.
If patching is delayed: SAP permits temporarily deactivating or deleting the relevant OData service in /IWFND/MAINT_SERVICE. The default technical service name is ZUI_SUBSTNVALDNRULE_MANAGE; the external name is UI_SUBSTNVALDNRULE_MANAGE. This blocks rule maintenance in related apps, including F4406. Assess that restriction with the business owner before implementation.
Additional hardening: Review assignment of the affected business roles and examine unexpected rule changes. These are supplementary controls, not substitutes for the correction.
SAP Security Note 3797111 (CVE-2026-89110) – Broken Access Control in SAP NetWeaver Visual Composer
Severity: Critical | CVSS: 9.9
Component scope: VC70RUNTIME 7.50.
Exposure profile: Authenticated, low-privileged attacker with access to the affected portal functionality; no user interaction required.
Affected Environments and Exposure
The critical dependency is the set of remote systems already configured for Visual Composer. SAP identifies RFC, BAPI and data-service functionality in the note. The scope of potential compromise depends on how those remote connections are configured, rather than on the portal user’s visible permissions alone.
Nature of the Vulnerability
Root issue: An existing security configuration was not enabled by default. Insufficient authorization checks allow low-privileged users to invoke internal operations on a preconfigured remote system. Depending on the connection configuration, SAP states that this could fully compromise that remote system.
Attack Scenarios
An authenticated portal user invokes functionality that reaches a configured backend connection. The authorization failure allows operations that should not be available to that user. The resulting impact may extend to the remote system; the note does not establish that every configured connection gives the same level of access.
Business Impact
The practical concern is access through a trusted connection. A restricted portal identity should not inherit more powerful access to a connected backend. Remediation planning should therefore include the remote destinations and their effective permissions, not just the Visual Composer runtime.
Mitigation and Recommendations
Patch guidance: Apply the support packages and patches referenced in Note 3797111. The correction changes the relevant configuration’s default value.
If patching is delayed: Follow the note’s referenced Setting Secure Mode instructions. SAP explicitly requires a manual restart of the com.sap.visualcomposer application in NetWeaver Administrator after applying those settings. A configuration change without that restart does not complete the documented procedure. [SAP Note 3797111]
Additional hardening: Inventory configured remote connections, review their authorizations, and validate the resulting access restrictions with a low-privileged test account.
SAP Security Note 3798788 (CVE-2026-89108) – Missing Authorization Check in SAP MII Configuration Service
Severity: Critical | CVSS: 9.1
Component scope: SAP Manufacturing Integration and Intelligence, XMII 15.4 and 15.5.
Exposure profile: Authenticated SAP XMII administrator with network access to the relevant endpoints; no user interaction required.
Affected Environments and Exposure
This issue affects the boundary between MII application administration and the underlying Java application server. An MII administrator is the required starting point; SAP does not describe exploitation by an ordinary, non-administrative MII user
Nature of the Vulnerability
Root issue: The Configuration Service does not sufficiently enforce authorization boundaries. An MII administrator can submit a crafted request to provision an account with elevated privileges on the underlying Java application server.
Attack Scenarios
A compromised or misused MII administrator account invokes the affected internal functionality to create a more privileged account. The correction specifically prevents users with SAP XMII Admin privileges from creating accounts with the SAP_J2EE_Engine_Admin role.
Business Impact
SAP explicitly describes the impact as extending beyond the vulnerable application. The risk is loss of administrative control over the underlying platform, with high impact across confidentiality, integrity and availability. Treating this as harmless because the attacker is “already an administrator” would overlook the privilege boundary being crossed.
Mitigation and Recommendations
Patch guidance: Implement the release-specific patches in Note 3798788. Listed fixed levels include XMII 15.4 SP001 Patch 059, and XMII 15.5 SP000 Patch 049, SP001 Patch 044 or SP002 Patch 015. Select the appropriate level for the installed release and support package.
If patching is delayed: SAP states that there is no workaround. Restricting administrative access and reviewing newly created accounts are additional containment and detection measures, not a replacement for the patch.
Review MII dashboard security separately under Note 3798823; its authoring and content-security controls do not resolve this Configuration Service vulnerability.
SAP Security Note 3800517 (CVE-2026-89113) – SQL Injection in SAP Commerce Cloud
Severity: High | CVSS: 8.8
Component scope: COM_CLOUD 2211-JDK21.
Exposure profile: Authenticated user with a valid session for an affected API; no user interaction required.
Affected Environments and Exposure
The affected functionality includes list APIs that incorporate an insufficiently validated request parameter into a search query. Applicability depends on access to those APIs, not simply on whether a storefront is publicly reachable.
Nature of the Vulnerability
Root issue: User-controlled input reaches database query construction without sufficient validation. An attacker can inject SQL commands through crafted requests. Data disclosure applies across all supported database engines; modification or deletion requires an engine that permits multi-statement execution, such as Microsoft SQL Server.
Attack Scenarios
An attacker with a valid API session manipulates the affected input parameter. The resulting query can expose database information and, where the database prerequisite is met, modify or delete data. Do not assume that a database which blocks multi-statement execution is unaffected: the disclosure risk remains.
Business Impact
The operational assessment should distinguish confidentiality exposure from destructive database impact. That distinction affects the response plan, but it does not remove the need to patch an affected installation.
Mitigation and Recommendations
Patch guidance: Apply 2211-jdk21.18 or a later patch as referenced in the note, then rebuild and redeploy the updated Commerce Cloud version. The correction validates and sanitizes the affected query input.
If patching is delayed: SAP provides a workaround that disables the affected input parameter. It also removes the associated sorting functionality from the impacted endpoints. Follow FAQ Note 3803053 for the implementation details and validate the effect on consumers of those APIs.
Additional hardening: Review API access and investigate unexpected query errors or abnormal use of the affected list functionality.
SAP Security Note 3765424 (CVE-2026-58249) – Memory Corruption in SAP NetWeaver and SAP Web Dispatcher ICM
Severity: High | CVSS: 7.5
Component scope: Affected HTTP/2-enabled NetWeaver/ABAP Platform, Web Dispatcher, Content Server and HANA XS components identified in the note.
Exposure profile: Unauthenticated network attacker; no user interaction required; availability impact only.
Affected Environments and Exposure
An installation is affected only when HTTP/2 is supported and enabled. SAP states that it is enabled by default for NetWeaver/ABAP Platform and Web Dispatcher releases with kernel 7.73 and higher. The listed 7.53/7.54 products and HANA XS configurations require HTTP/2 to have been explicitly enabled. NetWeaver Application Server Java is not affected.
Nature of the Vulnerability
Root issue: A program error in the HTTP/2 implementation allows malformed requests to trigger a memory-handling error and crash the affected process. SAP assesses high availability impact, with no confidentiality or integrity impact. This note describes denial of service, not the code-execution impact of the critical notes above.
Attack Scenarios
An unauthenticated attacker sends a crafted request to an affected HTTP/2 listener, causing the process to crash. There is no need to obtain a business role, compromise an administrator, or persuade a user to interact. [SAP Note 3765424]
Business Impact
Where an affected dispatcher or communication process fronts business-critical applications, an availability-only flaw can still interrupt important services. That makes actual network reachability a key factor in deciding whether this High note belongs in the same emergency change window as the Critical notes.
Mitigation and Recommendations
Patch guidance: Use the component-specific corrections in Note 3765424. The delivery mechanism differs for standalone Web Dispatcher, ICM/embedded Web Dispatcher, HANA XSC, XSA and Content Server; do not assume one kernel deployment covers every listed component.
If patching is delayed: Follow SAP’s HTTP/2-disabling procedure, using icm/HTTP/support_http2=FALSE where specified. SAP states that disabling HTTP/2 does not change functionality, but may reduce browser UI performance. Persist the change and follow the runtime or restart instructions for the particular component.
For ABAP, the note supports changing the value at runtime across servers without a restart. Content Server’s procedure requires removing the enabling profile parameter and restarting. Applying the workaround only at Web Dispatcher is sufficient only for the access paths SAP specifies as exclusively routed through that dispatcher.
SAP Security Note 3626303 (CVE-2026-89120) – Missing Authorization Check in SAP ABAP Platform
Severity: High | CVSS: 7.1
Component scope: SAP kernel 7.93 and 9.16.
Exposure profile: Authenticated, low-privileged attacker; no user interaction required.
Affected Environments and Exposure
The issue concerns single-transaction mode, including access from Fiori Launchpad. An API change reintroduced a previously corrected authorization weakness that allows the session manager to be opened from a restricted context.
Nature of the Vulnerability
Root issue: A regression permits unintended access to the Easy Access Menu. Crafted requests can bypass the intended restrictions, with high integrity impact and low confidentiality impact. SAP reports no availability impact.
Attack Scenarios and Business Impact
A low-privileged user escapes the intended single-transaction restriction through the affected session-management behavior. The security concern is failure of that access restriction; the note should not be read as evidence that every underlying business authorization is bypassed. Validation should test the restricted entry point as well as legitimate user workflows.
Mitigation and Recommendations
Patch guidance: Note 3626303 lists corrections from kernel 7.93 Patch 320 and kernel 9.16 Patch 011. Follow the note’s kernel-update guidance and review the regression information for the selected target level.
If patching is delayed: SAP provides no workaround. Where this note and the HTTP/2 note both apply, select a kernel target that includes both corrections, rather than treating the lower minimum level as sufficient for the entire patch cycle.
Medium and Lower Priority Notes
1) Enterprise Portal, SAPUI5 and Browser-Facing ABAP Applications
These notes address different browser and information-disclosure paths. Keep the components distinct: EP-RUNTIME, EP-ADMIN, SAPUI5 and ABAP application corrections are not interchangeable.
| SAP Note / CVE | CVSS | Component | Practical Risk |
|---|---|---|---|
| 3790401 / CVE-2026-89122 | 6.1 | Enterprise Portal, EP-RUNTIME 7.50 | A malicious link can load attacker-controlled content in the trusted application context. SAP removes the vulnerable endpoint. |
| 3789825 / CVE-2026-89118 | 5.3 | Enterprise Portal, EP-RUNTIME 7.50 | Anonymous endpoints disclose restricted, non-critical application information. The correction blocks access. |
| 3779985 / CVE-2026-89117 | 6.1 | Enterprise Portal, EP-ADMIN 7.50 | Reflected XSS can expose session information or manipulate displayed content when a user visits a crafted URL. |
| 3794572 / CVE-2026-76975 | 6.1 | SAPUI5 Support Assistant Overlay, SAP_UI 754 | A crafted link can trigger DOM-based XSS in an authenticated user’s active session. |
| 3799054 / CVE-2026-89106 | 4.4 | SAPUI5 URL validation | Unsafe allowlist configurations can permit XSS through user-supplied HTML. The fix blocks dangerous protocols for unspecific entries by default. |
| 3671819 / CVE-2026-76976 | 5.4 | SAP GUI for HTML applications | An authenticated attacker can provide malicious content that executes when another user interacts with it. |
| 3629325 / CVE-2025-42938 | 6.1 | ABAP Platform; listed CRM components | Crafted links can execute malicious content in an authenticated user’s browser. Apply the correction and applicable manual instructions. |
Implementation details matter. For SAP_UI 754, both SAPUI5 notes reference 1.71.85 as a minimum. Other release tracks must follow the version-specific levels in Note 3799054. Review custom allowlists carefully: an entry added by one SAPUI5 application also affects other SAPUI5 applications running on the same page.
The GUI for HTML correction can remove src and href attributes that use blocked schemes such as data: or blob:. SAP specifically notes that legitimate inline base64 images may need to be replaced with server-hosted resources. For Note 3629325, the specified S4CEXT 107/108 levels also require Note 3499472, including its correction instructions.
Practical takeaway: Validate rendered content and legitimate navigation, not only patch status. Avoid restoring broad, unsafe URL permissions simply to make an older customization work.
2) Business-Object Authorization Gaps
| SAP Note / CVE | CVSS | Component | Practical Risk |
|---|---|---|---|
| 3810872 / CVE-2026-89124 | 4.3 | GTS, edition for SAP HANA; GTSCORE 200/300 | Low-privileged authenticated users can access product-catalog information beyond their authorized scope in the customs-declaration application. |
| 3799621 / CVE-2026-89121 | 4.7 | S/4HANA Linear Asset Management RAP business object; S4CORE 109 | A low-privileged attacker with local access can bypass instance-level checks and modify unauthorized object data. SAP rates integrity impact as high and attack complexity as high. |
The Linear Asset Management correction extends Read, Modify and Create checks to follow the parent business object’s authorization concept. The GTS correction restricts access to the required permissions.
Practical takeaway: Include negative authorization tests: a permitted user should retain access, while a user outside the intended object or information scope should be denied.
3) MII Dashboard Governance and ABAP Test Functionality
Note 3798823 / CVE-2026-76972 – MII stored XSS, CVSS 6.5. This is a consulting note with explicit security measures, not a conventional software-patch instruction. Restrict XMII_SSCE_CHANGE and XMII_SSCE_ALL to required dashboard authors; require version control and administrator approval; review external references; and use the NWDI transport process instead of direct production editing. Configure Content Security Policy according to the referenced guidance: CSP is not enabled by default.
Note 3689080 / CVE-2026-24316 – ABAP test-report SSRF, CVSS 6.4. An authenticated user with permission to execute arbitrary reports can use the affected testing report to send requests to internal or external endpoints. SAP removes the unused report. Include SAP_BASIS 816 SP00 in the applicability check for the supplied October version.
Practical takeaway: Content-authoring permissions and obsolete test utilities belong in the same security review as software updates. They should not remain outside the remediation plan merely because they are not headline vulnerabilities.
4) SAP Cloud Connector – Improper Authorization Check
Note 3767634 / CVE-2026-58242 – Improper authorization check, CVSS 3.5 (Low). SAP Cloud Connector 2.0 allows a low-privileged attacker on an adjacent network to obtain limited information about internal systems through specially crafted requests. No user interaction is required. Confidentiality impact is low; integrity and availability are unaffected.
Patch guidance: The correction adds the authorization check and is available from SAP Cloud Connector 2.19.1. Upgrade affected installations using SAP’s Cloud Connector upgrade procedure. The note does not describe a workaround.
Practical takeaway: Include Cloud Connector in the patch inventory without treating this limited information-disclosure issue as equivalent to the Critical notes. As additional hardening, review access from adjacent networks; this does not replace the correction.
Additional Notes Dated 22 September 2026
The review also includes the following three September-dated notes. They remain relevant where unresolved, but are separate from the eighteen October-dated entries.
| SAP Note / CVE | Severity / CVSS | Component | Required Follow-Through |
|---|---|---|---|
| 3485073 / CVE-2026-66766 | High / 7.5 | S/4HANA Manage Supply Protection | A vulnerable SheetJS component can cause excessive processing and denial of service. Apply the correction. SAP’s temporary workaround is to avoid Protection Group upload functionality and enter values manually. |
| 3680888 / CVE-2026-76974 | Medium / 5.3 | Fiori Launchpad | A crafted link can load external attacker-controlled content and expose sensitive session information. Apply the correction for secure handling of null or empty UCON results. Confidentiality impact is rated high despite the Medium overall score. |
| 3678417 / CVE-2026-0505 and CVE-2026-24323 | Medium / 6.1 | Document Management System BSP applications | Open redirect and XSS through URL parameters. SAP’s correction deprecates the vulnerable functions and parameters; validate document-related navigation after implementation. |
Defender’s Perspective: What October Tells Us
First, the most serious failures cross privilege boundaries. The three Critical notes involve business-rule access becoming executable ABAP, portal access reaching privileged backend operations, and MII administration becoming Java platform administration. Reviewing only the role name assigned to a user would miss the resulting reach.
Second, exposure conditions change the practical priority. HTTP/2 must be enabled for the ICM issue; the Commerce SQL-injection consequences depend partly on the database engine; Visual Composer’s remote-system impact depends on its connection configuration; and the Cloud Connector issue requires adjacent-network access. Those conditions should determine the remediation queue alongside CVSS, not disappear in a generic affected-product inventory.
Third, remediation quality is a security control. October includes a kernel regression, a security setting that was not enabled by default, a consulting note requiring explicit CSP and authoring controls, and browser fixes with rendering consequences. Validation must establish that the intended restriction now works and that essential business functionality still behaves correctly.
Final Recommendations
Patch Prioritization
Priority 0 – Immediate: Address 3805589, 3797111 and 3798788 in applicable S/4HANA, Visual Composer and MII environments. Use the documented S/4HANA service-deactivation or Visual Composer Secure Mode procedures only as temporary measures. There is no SAP workaround for the MII Configuration Service issue.
Priority 1 – High-severity and exposed services: Address 3800517, 3765424 and 3626303. Move reachable HTTP/2 listeners or affected externally accessible Commerce APIs into the immediate change window where exposure warrants it. Include September Note 3485073 where still unresolved. Verify that kernel targets cover every applicable correction and that Commerce changes are actually rebuilt and deployed.
Priority 2 – Browser and information-exposure paths: Queue the Portal, SAPUI5, GUI for HTML and CRM-related fixes according to reachability and user exposure. Complete the MII dashboard controls and ABAP SSRF correction in the same remediation cycle. Include the September Fiori Launchpad and DMS notes where applicable.
Priority 3 – Remaining business-object and connector corrections: Complete the GTS and Linear Asset Management fixes with application-owner validation. Include 3767634 in the Cloud Connector maintenance plan and upgrade affected installations to 2.19.1 or later. Assess its adjacent-network exposure and limited information-disclosure impact without treating it as equivalent to the Critical notes.
Defense-in-Depth Beyond Patching
Reduce unnecessary access. Review who can maintain substitution/validation rules, administer MII, author dashboards, invoke Visual Composer functionality, and execute arbitrary ABAP reports. Keep these activities limited to the intended responsibilities.
Review connected-system permissions. Assess what each Visual Composer destination can do, and keep MII application administration distinct from Java server administration. Include Cloud Connector access in that review, with particular attention to the adjacent-network access described in Note 3767634. These are additional hardening recommendations; the documented software corrections remain necessary.
Increase detection. Recommended monitoring includes unexpected rule changes, new Java administrative accounts, unusual calls through configured backend connections, abnormal Commerce API/query behavior, and repeated ICM or Web Dispatcher crashes. Treat these as investigation signals, not proof of exploitation by themselves.
Validate the Outcome
Close the patch cycle with evidence that the control is effective: confirm the corrected component and kernel levels; verify the Commerce build and deployment; test Visual Composer’s access restrictions; and check that MII administrators cannot create Java engine administrator accounts through the affected functionality.
Validate HTTP/2 settings across every reachable instance and persist temporary changes correctly. Test authorized and unauthorized business-object access, review legitimate SAPUI5 and GUI for HTML content, and confirm that Cloud Connector has been upgraded to 2.19.1 or later and that intended connectivity still works. Obtain business approval before restoring services or features disabled as workarounds.
October’s objective is not just to install the highest-scoring notes. It is to prevent application permissions from becoming system control, close unauthenticated outage paths, and verify that each correction remains effective in the actual landscape.
