SAP Security Patch Day – October 2026
Chapters
Share Article
Let's Talk SAP Security
Have questions about SAP Security? We’re here to help. Contact Us
SAP has released 16 new and 2 updated Security Notes today. Together with the 3 notes released since the last Patch Day, this brings the total to 21 Security Notes to review in this October patch cycle.
Always remember: many successful attacks exploit vulnerabilities for which patches are already available. Applying security patches as quickly as possible remains one of the most effective ways to reduce exposure to known vulnerabilities and limit the attack surface across SAP landscapes.
The SecurityBridge Patch Management for SAP solution helps organizations identify missing patches across their SAP landscape, providing clear visibility, impact analysis, and automated implementation support. By offering a system-wide overview, it helps accelerate patching cycles and strengthen continuous threat monitoring, contributing to a more secure and resilient SAP environment throughout 2026.
Highlights
HotNews:
- Note 3797111 and 3805589 can both be mitigated with a workaround. Apply these ASAP before the patch can be applied.
- Note 3798788 cannot be mitigated with a workaround, keep the number of MII administrators to a minimum until the patch is applied.
High Priority:
- Note 3485073: implement the correction for UIS4HOP1 800/900; until then, enter Protection Group values manually instead of using the upload.
- Note 3765424 : update the kernel or Web Dispatcher where HTTP/2 is enabled, which is the default as of release 7.73; AS Java is not affected, and a workaround is available.
SAP Security Notes October 2026
Summary by Severity
The October release contains 16 new and 2 updated Security Notes, plus 3 notes released between the September and October Patch Days. :
Component overview
Where this month's risk concentrates: the number of Security Notes per component area and priority.
Security Notes - Overview
Below are all 21 Security Notes of this Patch Day, sorted by CVSS score.
• Workaround: shows whether the note offers a temporary mitigation.
• Manual activity shows whether implementing the note takes more than only applying the patch.
| Note | Description | Severity | CVSS | Workaround | Manual activity |
|---|---|---|---|---|---|
| 3797111 | [CVE-2026-89110] Broken Access Control in SAP NetWeaver Visual Composer Released on: 10/13/26 Components: EP-VC-RTM Category: Program error | HotNews | 9.9 | Yes | No |
| 3805589 | [CVE-2026-89107] Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) Released on: 10/13/26 Components: FI-SL-VSR Category: Program error | HotNews | 9.9 | Yes | No |
| 3798788 | [CVE-2026-89108] Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) Released on: 10/13/26 Components: MFG-MII Category: Program error | HotNews | 9.1 | No | No |
| 3800517 | [CVE-2026-89113] SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) Released on: 10/13/26 Components: CEC-SCC-PLA-PL Category: Program error | High | 8.8 | Yes | No |
| 3485073 | [CVE-2026-66766] Denial of Service (DoS) due to use of third-party component in SAP S/4HANA (Manage Supply Protection) Released on: 9/22/26 Components: CA-ATP-SUP Category: Program error | High | 7.5 | Yes | No |
| 3765424 | [CVE-2026-58249 ] Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) Released on: 10/13/26 Components: BC-CST-IC Category: Program error | High | 7.5 | Yes | No |
| 3626303 | [CVE-2026-89120] Missing authorization check in SAP ABAP Platform Released on: 10/13/26 Components: BC-ABA-SC Category: Program error | High | 7.1 | No | No |
| 3798823 | [CVE-2026-76972] Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence Released on: 10/13/26 Components: MFG-MII Category: Consulting | Medium | 6.5 | No | Yes |
| 3689080 | [CVE-2026-24316] Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP Released on: 10/13/26 Components: BC-TWB-TST-ECA Category: Program error | Medium | 6.4 | No | No |
| 3629325 | [CVE-2025-42938] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform Released on: 10/13/26 Components: CRM-BF-ML Category: Program error | Medium | 6.1 | No | Yes |
| 3678417 | [CVE-2026-0505] Multiple vulnerabilities in BSP Applications of SAP Document Management System Released on: 9/22/26 Components: CA-DMS-OP Category: Program error | Medium | 6.1 | No | No |
| 3779985 | [CVE-2026-89117] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal Released on: 10/13/26 Components: EP-PIN-URL Category: Program error | Medium | 6.1 | No | No |
| 3790401 | [CVE-2026-89122] Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal Released on: 10/13/26 Components: EP-PIN-NAV Category: Program error | Medium | 6.1 | No | No |
| 3794572 | [CVE-2026-76975] Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) Released on: 10/13/26 Components: CA-UI5-CTR-ROD Category: Program error | Medium | 6.1 | No | Yes |
| 3671819 | [CVE-2026-76976] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) Released on: 10/13/26 Components: BC-FES-CTL Category: Program error | Medium | 5.4 | No | No |
| 3680888 | [CVE-2026-76974] Information Disclosure vulnerability in SAP Fiori Launchpad Released on: 9/22/26 Components: CA-FLP-FE-COR Category: Program error | Medium | 5.3 | No | No |
| 3789825 | [CVE-2026-89118] Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal Released on: 10/13/26 Components: EP-PIN-CS Category: Program error | Medium | 5.3 | No | No |
| 3799621 | [CVE-2026-89121] Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) Released on: 10/13/26 Components: PM-LAM Category: Program error | Medium | 4.7 | No | No |
| 3799054 | [CVE-2026-89106] Cross Site Scripting (XSS) vulnerability in SAPUI5 Released on: 10/13/26 Components: CA-UI5-COR Category: Program error | Medium | 4.4 | No | Yes |
| 3810872 | [CVE-2026-89124] Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration) Released on: 10/13/26 Components: FT-LEG-CUS-MDT Category: Program error | Medium | 4.3 | No | No |
| 3767634 | [CVE-2026-58242] Improper Authorization check in SAP Cloud Connector Released on: 10/13/26 Components: BC-MID-SCC Category: Program error | Low | 3.5 | No | No |
