A vulnerability in SAP software could allow a user with legitimate access to gain far greater control over an enterprise system than intended.
SAP’s Oct. 13 security updates fix a critical code injection flaw in S/4HANA and a separate high-severity memory corruption vulnerability affecting NetWeaver and Web Dispatcher.
For organizations running affected systems, exposure depends on how the software is configured and who can access vulnerable components.
Business-rule inputs could execute unauthorized code
CVE-2026-89107, a critical vulnerability rated 9.9 under CVSS, affects the Manage Substitution/Validation Rules function in S/4HANA. According to Onapsis’ October patch analysis, insufficient input validation could allow specially crafted rule definitions to execute arbitrary ABAP code.
Exploitation requires an authenticated account with a specific SAP Fiori business role. Attackers with those privileges could potentially gain full control of the affected system.
S4CORE versions 105 through 109 are vulnerable. SAP addressed the flaw in Security Note 3805589.
Memory corruption could disrupt SAP services without authentication
A separate vulnerability, CVE-2026-58249, impacts the Internet Communication Manager used by NetWeaver and Web Dispatcher. Rated 7.5 under CVSS, the flaw involves improper validation of network requests that can trigger memory errors and crash an affected process.
Attackers do not need valid login credentials, although the target installation must support HTTP/2 and have the protocol enabled. A resulting denial-of-service attack could interrupt access to SAP applications that employees depend on for daily work.
The October security bulletin identifies affected kernel and Web Dispatcher components, along with SAP Content Server and certain HANA application services. Security Note 3765424 covers remediation.
How SAP administrators should prioritize remediation
If you manage S/4HANA, NetWeaver, or Web Dispatcher installations, the highest CVSS score should not automatically determine which system gets patched first. Effective vulnerability prioritization also considers whether attackers can reach a service and how much disruption its failure would cause.
SAP Basis administrators and enterprise security teams should coordinate their response around several checks.
- Identify affected installations. Compare installed S4CORE releases and relevant web-facing components against the security notes. Include connected services where applicable, and establish which systems actually need updates before scheduling maintenance.
- Review business-rule permissions. Identify accounts authorized to manage substitution and validation rules, examine recent changes for suspicious activity, and remove unnecessary privileges. Existing privileged access controls should account for sensitive application-level roles.
- Check HTTP/2 exposure. Determine which affected services accept connections from untrusted networks. Restrict unnecessary access while preparing fixes, particularly where an application outage could interrupt important business operations.
- Coordinate workarounds and patch testing. Deactivating the affected OData service is a temporary workaround for the S/4HANA flaw, according to Onapsis. It prevents legitimate users from adding, modifying, or deleting substitution and validation rules through related Fiori applications. Confirm the business impact with application owners and follow a patch management process that includes testing before and after deployment.
Systems that cannot be updated immediately should have an assigned owner, documented temporary protections, and a scheduled follow-up. Leaving those decisions unresolved can extend exposure well after a security fix becomes available.
More cybersecurity news: SAP Cloud SDK users face credential exposure risk from a critical vulnerability that may require more than a routine patch check.