Topic

SAP NetWeaver

Reporting and analysis related to SAP NetWeaver.

Articles: 1
Desk: 1

Data graphic: Dot plot of SAP's October 2026 Patch Day notes by CVSS, axis starting at 7.0. NetWeaver Visual Composer CVE-2026-89110 ties S/4HANA rules CVE-2026-89107 at 9.9, ahead of MII 9.1, Commerce Cloud SQLi 8.8 and ICM / Web Dispatcher 7.5. Patch Visual Composer first with SAP Note 3797111; it needs a low-privilege login, unlike the unauthenticated 2025 flaw, and no exploitation is reported.

highExploits SAP NetWeaver

SAP Patch Day: another critical 9.9 in NetWeaver Visual Composer, the component behind the 2025 zero-day attacks

SAP's October 2026 Patch Day fixes a 9.9 access-control flaw in NetWeaver Visual Composer (CVE-2026-89110), plus 9.9 S/4HANA and 9.1 MII criticals.

Oct 18 · 4 min