Threat Alerts

October 2026 SAP security updates address critical code injection, broken access control, SSRF and a high-severity memory corruption flaw across S/4HANA, NetWeaver, Web Dispatcher, Commerce Cloud and development libraries. Successful exploitation of these vulnerabilities could enable credential theft, unauthorized execution of internal operations, arbitrary code execution, privilege escalation, and complete system compromise.

The critical vulnerabilities include CVE-2026-89111 (CVSS Score 10.0), a server-side request forgery (SSRF) flaw in Cloud SDK for Python that could allow attackers to redirect OAuth2 token requests and exfiltrate client credentials.
CVE-2026-89110 (CVSS Score 9.9), a broken access control vulnerability in NetWeaver Visual Composer that could enable low-privileged attackers to invoke internal operations and compromise remote systems. CVE-2026-89107 (CVSS Score 9.9), a code injection vulnerability in S/4HANA that could allow authenticated attackers with specific business roles to execute arbitrary ABAP code, and CVE-2026-89108 (CVSS Score 9.1), a missing authorization check in SAP MII that could enable attackers with XMII Admin privileges to create administrator accounts on the underlying Java application server.

The release also addresses high-severity vulnerabilities affecting SAP Commerce Cloud, NetWeaver, and ABAP Platform, potentially allowing SQL injection, process crashes, and security restriction bypasses. At the time of disclosure, there were no confirmed reports of active exploitation of the newly patched vulnerabilities in the wild.

A high-severity use-after-free vulnerability in curl and libcurl, tracked as CVE-2026-92392 (CVSS 8.1), could allow a malicious HTTP/2 server to corrupt client memory and potentially achieve remote code execution. The curl project rates the issue High under its own four-level severity scale. Exploitation requires a client to upload a file of approximately 135 KB over HTTP/2 to an attacker-controlled server with a certificate trusted by the client. By stalling the upload, partially responding, resetting the stream, and keeping the connection open, the server can trigger a retry and leave a stale pointer to a freed transfer object on the original HTTP/2 connection.

The demonstrated exploit abuses the dangling pointer to corrupt freed memory, leak local addresses to bypass ASLR, overwrite a function pointer with attacker-controlled data and trigger its execution. However, reliable code execution requires precise knowledge of the target’s version, architecture, memory allocator, heap layout and timing across concurrent transfers, making a crash the more likely outcome. The vulnerability was fixed through a six-line code change that reorders cleanup so the HTTP/2 layer releases references only after remaining upload data is flushed.

A high-severity Linux kernel vulnerability, tracked as CVE-2026-74580 (CVSS 8.8) and referred to as Vghost, affects the kernel’s vhost subsystem. The flaw stems from stale IOTLB metadata-cache entries that can persist after virtual-ring configurations are changed, allowing subsequent memory operations to use outdated mappings. A local attacker with access to /dev/vhost-* devices may abuse the issue to obtain arbitrary kernel memory read/write capabilities and ultimately escalate privileges to root.

The same vulnerability can also introduce a virtual machine escape path under specific virtualization configurations. Environments using a virtual IOMMU together with iommu_platform and affected virtio functionality may allow a malicious guest to trigger out-of-bounds writes into the host QEMU process, potentially resulting in control-flow hijacking. The issue has been reproduced across several enterprise Linux distributions, including Ubuntu, RHEL, Amazon Linux, Azure Linux, and Oracle Linux.

Two critical vulnerabilities have been disclosed in Next.js, both carrying a CVSS score of 9.5 – Critical and capable of enabling unauthenticated remote code execution (RCE) under specific conditions. The first vulnerability, currently unassigned a CVE (CVSS 9.5 – Critical), affects Next.js 16.0.0 through 16.4.0 and impacts applications using the App Router with Cache Components. Exploitation may occur when a use cache function returns multiple typed arrays, potentially allowing a remote attacker to execute arbitrary code without authentication or user interaction.

The second vulnerability, CVE-2026-96889 (CVSS 9.5 – Critical), affects the Next.js Image Optimization API when processing attacker-controlled SVG files on glibc-based Linux systems. The flaw affects Next.js 10.0.0 through 15.5.27 and 16.0.0 through 16.4.0 and may allow a remote attacker to achieve code execution on the underlying server through specially crafted image content.

Both vulnerabilities are addressed in Next.js 16.4.1, while affected 15.x deployments should upgrade to 15.5.28 where applicable. Because the first vulnerability currently has no assigned CVE, organizations relying only on CVE-based vulnerability scanning or npm audit may fail to identify all affected deployments.

A critical vulnerability, tracked as CVE-2026-76519 (CVSS 9.8), affects the Advanced Malware Protection (AMP) feature in Cisco Secure Email Gateway. The flaw is caused by improper handling of email attachments when the File Reputation service is enabled. An unauthenticated remote attacker can exploit the vulnerability by sending an email containing a specially crafted attachment through an affected gateway. Successful exploitation can allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.

The vulnerability affects physical and virtual Cisco Secure Email Gateway appliances running vulnerable AsyncOS releases when File Reputation is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525. Cisco Secure Email and Web Manager and Secure Web Appliance are not affected. Cisco confirmed active exploitation of CVE-2026-76519 in October 2026, increasing the urgency for organizations operating vulnerable gateways.

Microsoft has released its October 2026 Patch Tuesday updates, addressing more than 1,400 vulnerabilities, including CVE-2026-96951 (CVSS 8.8), an actively exploited zero-day vulnerability affecting Windows Shell. The command injection flaw allows attackers to bypass Mark of the Web (MotW) protections, which normally identify files originating from untrusted sources and trigger security controls such as Microsoft Defender SmartScreen warnings and Office Protected View.

Exploitation requires user interaction, typically involving a specially crafted file delivered through phishing emails, messaging platforms, or malicious websites. Successful exploitation could allow malicious content to bypass these protections, increasing the risk of malware execution. This is the third Windows Shell vulnerability exploited in the wild during 2026, although the threat actors responsible for the latest attacks have not been identified. The vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, making patching a priority.