Vulnerabilities in SAP Products · CIAD-2026-0048
CERT-In advisory CIAD-2026-0048 · 14 Oct 2026
Official title
CIAD-2026-0048 : Multiple Vulnerabilities in SAP Products
Official record
Open source pageSummary
Check the official recordWhat changed
Multiple vulnerabilities exist in various SAP products that allow attackers to execute arbitrary code, bypass security controls, or disclose sensitive information. These flaws result from improper access control, missing authorization checks, and various injection types including SQL and operating system command injection. Attackers exploit these vulnerabilities by sending specially crafted requests or providing malicious input to the targeted systems. Affected organizations must apply the security updates provided by SAP to mitigate these risks. The vulnerabilities impact a wide range of SAP software including SAP NetWeaver, SAP S/4HANA, SAP Commerce Cloud, and SAP Cloud SDK for Python. Users should consult the official SAP security notes for October 2026 to identify and install the necessary patches for their specific software versions.
What you must do
- Apply appropriate updates as mentioned by the vendor.
Key dates
- Original Issue Date
- 14 Oct 2026
Document text
CERT-In Advisory CIAD-2026-0048
Multiple Vulnerabilities in SAP Products
Original Issue Date: October 14, 2026
Severity Rating: Critical
Software Affected
SAP Cloud SDK for Python versions prior to 0.45.2 SAP NetWeaver Visual Composer ¿ VC70RUNTIME 7.50 SAP S/4HANA (Manage Substitution/Validation Rules) ¿ S4CORE versions 105, 106, 107, 108, 109 SAP Manufacturing Integration and Intelligence (SAP MII) ¿ XMII versions 15.4 and 15.5 SAP Commerce Cloud ¿ COM_CLOUD version 2211-JDK21 SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) ¿ HDB 2.00; KRNL64UC 7.53; WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16; XS_ADVANCED_RUNTIME 1.00; SAP_EXTENDED_APP_SERVICES 1; CONTSERV 7.53, 7.54; KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19, 9.20 SAP ABAP Platform ¿ KERNEL versions 7.93 and 9.16 CLA-Assistant versions prior to or equal to 2.13.1 SAP NetWeaver Application Server for ABAP ¿ SAP_BASIS versions 740, 750, 752, 753, 754, 755, 756, 757, 758, 816, 918 SAP NetWeaver ABAP Platform ¿ S4CRM versions 100, 200, 204, 205, 206; S4CEXT versions 107, 108; BBPCRM versions 713, 714 SAP NetWeaver Enterprise Portal ¿ EP-ADMIN 7.50; EP-RUNTIME 7.50 SAPUI5 (Support Assistant Overlay) ¿ SAP_UI 754 Yeoman-UI / Application Wizard Extension for Visual Studio Code versions prior to or equal to 1.25.1 SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) ¿ SAP_BASIS versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758, 816 SAPUI5 ¿ SAP_UI versions 750, 754, 755, 756, 757, 758, 816; UI_700 version 200 SAP S/4HANA (Linear Asset Management RAP Business Object) ¿ S4CORE 109 SAP Global Trade Services, edition for SAP HANA ¿ GTSCORE versions 200 and 300 SAP Cloud Security Services Integration Library versions 3.6.6 and later, but prior to 4.1.1 SAP Cloud Connector ¿ SAP_CLOUD_CONNECTOR 2.0
Overview
Multiple vulnerabilities have been reported in SAP products, which could allow an attacker to execute arbitrary code or commands, bypass security controls, gain unauthorized access, disclose sensitive information, manipulate data, or cause denial-of-service conditions on the targeted system.
Target Audience:
All end-user organizations and individuals using SAP Products.
Risk Assessment:
High risk of security restriction bypass, remote code execution, sensitive information disclosure, denial-of-service.
Impact Assessment:
Potential for remote code execution, security restriction bypass, information disclosure and/or denial-of-service.
Description
SAP is an enterprise software provider offering business applications and platforms for enterprise resource planning, application development, data management, manufacturing integration, e-commerce, and cloud services.
Multiple vulnerabilities exist in SAP products due to improper access control, missing authorization checks, server-side request forgery (SSRF), code injection, SQL injection, memory corruption, cross-site scripting (XSS), open redirection, operating system command injection, information disclosure, and improper authentication. An attacker could exploit these vulnerabilities by sending specially crafted requests, providing malicious input, or accessing functions without proper authorization to bypass security controls, execute arbitrary code or commands, access sensitive information, or manipulate data on the targeted system.
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code or commands, gain unauthorized access, disclose sensitive information, manipulate data, or disrupt the availability of the targeted system.
Solution
Apply appropriate updates as mentioned by the vendor:
Vendor Information
SAP
References
CVE Name
CVE-2026-89110 CVE-2026-89107 CVE-2026-89108 CVE-2026-89113 CVE-2026-58249 CVE-2026-89120 CVE-2026-89112 CVE-2026-76972 CVE-2026-24316 CVE-2025-42938 CVE-2026-89117 CVE-2026-76975 CVE-2026-89122 CVE-2026-89116 CVE-2026-76976 CVE-2026-89118 CVE-2026-89121 CVE-2026-89106 CVE-2026-89124 CVE-2025-89105 CVE-2026-58242 CVE-2026-89111
Source details
- Source
- Indian Computer Emergency Response Team
- Type
- advisory
- Published by source
- 14 Oct 2026
- Document number
- CIAD-2026-0048
- Issuing division
- CERT-In
- Coverage area
- cybersecurity