The Hacker News

SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

Six SAP Cloud SDK for Python releases skip tenant checks in Destination calls, enabling OAuth2 client secret leaks if ...
Computing

SAP patches critical Python SDK flaw that could expose OAuth credentials

SAP has patched a maximum-severity flaw in its Cloud SDK for Python that could expose OAuth credentials in multi-tenant BTP ...

SAP Vulnerabilities Are Not Someone Else's Problem: Thinking About ERP Security Through CVSS 10.0 and Accounting Rule Flaws

On October 13, 2026, SAP released 16 new security notes and 4 GitHub security advisories during its regular Security Patch ...

SAP warns of maximum severity OAuth2 SSRF security flaw

SAP has addressed 20 security flaws across multiple products in its October 2026 security updates, including a ...

SAP BTP Also Had a CVSS 10.0 Vulnerability—The Misconception That "SAP Protects Us Because It's the Cloud"

On October 21, 2026, a critical vulnerability was discovered in PHP, and an emergency security update was released.These are ...
Forkast News

SAP Cloud SDK for Python Lets Attackers Steal OAuth2 Credentials Through a Tenant Subdomain Input — CVSS 10.0

The eleventh trust-through-defaults incident in 21 days hit SAP's enterprise SDK layer. A regression in six later releases shows how fragile the fix class really is.

SAP Patchday: Attackers can take over systems

Important security updates have been released for SAP Cloud SDK for Python, among others. Admins should act promptly.
SecurityWeek

SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

SAP has patched critical flaws in Cloud SDK for Python, NetWeaver, S/4HANA, and Manufacturing Integration and Intelligence.