October 2026 · 20 notes
Patch ArchiveOctober 2026 SAP Security Patches
Every SAP Security Note from Patch Tuesday October 13, 2026, ranked by tier and CVSS score.
3
Critical
3
High
13
Medium
1
Low
Tier 1 · Always covered
Products in virtually every SAP environment. Patch these first, every month.
Code Injection in Substitution/Validation Rule Management
Weak input validation in the rule-management app lets rule input be executed as ABAP. A user holding the relevant rule-management business role could run arbitrary code without any administrator rights.
Memory Corruption in ICM HTTP/2 Handling
Memory corruption in the Internet Communication Manager lets an unauthenticated attacker crash processes through HTTP/2 traffic, disrupting availability. Only systems with HTTP/2 enabled and reachable are exposed.
Missing Authorization Check in Single-Transaction Mode (Regression)
A missing authorization check in the ABAP kernel when running in single-transaction mode. Described as a regression, meaning a previously closed gap reopened.
Session Information Exposure via Crafted Link in Fiori Launchpad
A crafted link can expose sensitive session information in Fiori Launchpad. Published September 22, 2026 and covered with the October cycle.
Tier 2 · Covered when notable
Products with real deployments that have something worth acting on this month.
Broken Access Control in Visual Composer Runtime
Users with limited privileges can reach a preconfigured backend system through Visual Composer and potentially compromise it. A temporary workaround exists but requires an application restart.
Missing Authorization Check in MII Configuration Service
A missing authorization check lets administrators create accounts with elevated rights on the underlying Java application server. No documented workaround.
SQL Injection in SAP Commerce Cloud
An SQL injection flaw in a request parameter. A temporary mitigation is to disable the affected parameter, at the cost of the sorting functionality.
Untrusted Content Loaded via Crafted Link in Enterprise Portal
A crafted link can cause the portal to load untrusted content (open-redirect style behaviour). Needs a victim to click.
Reflected XSS in Enterprise Portal Administration
Reflected cross-site scripting in the portal administration component.
Information Disclosure via Anonymous Portal Endpoints
Certain portal endpoints reachable without logging in disclose information.
DOM-Based XSS in SAPUI5 Support Assistant Overlay
DOM-based cross-site scripting in the Support Assistant overlay.
XSS via Unsafe URL Allowlist Configuration in SAPUI5
Cross-site scripting when URL validation relies on an unsafe allowlist configuration.
Malicious Content Execution in SAP GUI for HTML
Cross-site scripting that allows malicious content to run in the SAP GUI for HTML client.
Malicious Content Execution via Crafted Links in CRM Components
Crafted links can lead to malicious content execution in the listed CRM components. This is an update to an older issue and also depends on a companion note.
Stored XSS in MII Dashboards
Stored cross-site scripting in MII dashboard content.
Server-Side Request Forgery in an ABAP Test Report
A test report in AS ABAP can be abused to make server-side requests. Listed as an update to an earlier note.
Open Redirect and XSS in DMS BSP Applications
Open redirect and cross-site scripting in the DMS BSP applications (also tracked as CVE-2026-24323). Published September 22, 2026 and covered with the October cycle.
Tier 3 · Critical CVEs only
Niche or SaaS-only products. Covered here when severity warrants it.
Authorization Gap Exposes Catalog Data in SAP GTS
Missing authorization check leads to over-exposure of catalog data.
Missing Instance-Level Authorization in Linear Asset Management
A RAP business object lacks instance-level authorization checks.
Improper Authorization Check in SAP Cloud Connector
Improper authorization check with limited information disclosure.