SAP Security Patch Day October 2026: what applies to your RISE system
On October 13 SAP released 20 new security notes, four of them rated critical. Not all of them affect S/4HANA on RISE with SAP, and among those that do, some are handled by your team and others by SAP ECS. Here we sort them out, together with the most serious open item from the previous month: OVERPASS, the CVSS 10.0 kernel memory corruption flaw.
This month at a glance
Official bulletin of October 13, 2026- Released
- 20 new entries (16 security notes and 4 GitHub advisories) plus 2 updates to earlier notes.
- Open from September
- OVERPASS (CVE-2026-44756), kernel memory corruption with CVSS 10.0. Note 3747649. On RISE, SAP ECS has applied it mandatorily since October 29.
- Top priority
- Note 3798788 for S/4HANA (Manage Substitution/Validation Rules), CVSS 9.9. It affects S4CORE 105 to 109 and is implemented by your team.
- Next date
- Tuesday, November 10, 2026, per SAP's calendar.
Before October: OVERPASS is still the most urgent item
If your landscape does not have the September patch yet, that comes before any note from this month. OVERPASS is the name Onapsis Research Labs gave to CVE-2026-44756: a memory corruption flaw in the SAP kernel's Extended Passport (EPP) processing, rated CVSS 10.0, the maximum score. SAP fixed it on September 8, 2026 with note 3747649.
It is this severe because EPP is processed when a session opens, before authentication, and that code is shared by the ICM and Web Dispatcher (HTTP), the dispatcher (SAP GUI) and the RFC layer. An attacker without credentials could run operating system commands with the privileges of the SAP administrative user. Roles, authorizations and password policies do not stop this attack. It affects kernels 7.22 to 9.20 and therefore S/4HANA, ECC, BW/4HANA, PI/PO, Solution Manager and Web Dispatcher.
On RISE, SAP ECS patches the kernel. Through September and most of October, applying the OVERPASS fix depended on the customer requesting it. Starting October 29, 2026, SAP ECS began applying it mandatorily for all customers. The only way to postpone it was to request, no later than October 23, an exception through a risk letter, in which your company formally accepts the risk of remaining unpatched. That exception only buys time until November.
If you neither applied the patch nor requested the exception, expect SAP ECS to apply it and confirm with your dCEM which window it will use in PRD, since it requires a restart. If you signed a risk letter, the extension ends in November, so it is worth scheduling the window with your dCEM now and keeping in mind that the vulnerability stays open until the patch is applied. Note 3756304 documents temporary measures for the HTTP path and note 3776034 answers frequently asked questions.
The same Patch Day included another critical kernel note, 3759472, for a missing authentication check in the Message Server (CVSS 9.8, kernel 9.16 to 9.20). It is worth confirming both in the same conversation with SAP ECS.
The notes that affect S/4HANA on RISE
We filtered the bulletin down to the components that are normally part of an S/4HANA Cloud Private Edition landscape: S4CORE, SAP_BASIS, SAP_UI, the kernel, the Web Dispatcher and HANA. The last column shows who handles each note under the standard RISE roles and responsibilities model.
| Note | Component and versions | CVSS | Handled by |
|---|---|---|---|
| 3798788 | Code injection in S/4HANA, Manage Substitution/Validation Rules. S4CORE 105, 106, 107, 108 and 109. | 9.9Critical | Your team |
| 3626303 | Memory corruption in the NetWeaver ICM and the Web Dispatcher. Kernel 7.53 to 9.20, Web Dispatcher and HANA 2.0. | 7.5High | SAP ECS |
| CVE-2026-89120 | Missing authorization check in ABAP Platform, fixed in the kernel. Kernel 7.93 and 9.16. | 7.1High | SAP ECS |
| 3629325 | Update to the March 2026 note: SSRF in AS ABAP. SAP_BASIS 740 to 918. | 6.4Medium | Your team |
| 3790401 | Cross-site scripting in SAPUI5, Support Assistant Overlay. SAP_UI 754. | 6.1Medium | Your team |
| 3789825 | Cross-site scripting in SAP GUI for HTML applications. SAP_BASIS 731 to 816. | 5.4Medium | Your team |
| 3799054 | Missing authorization check in Linear Asset Management (RAP). S4CORE 109. | 4.7Medium | Your team |
| 3810872 | Cross-site scripting in SAPUI5. SAP_UI 750 to 816 and UI_700 200. | 4.4Medium | Your team |
If your company runs S/4HANA for CRM or the S4CEXT extension, also review the update to note 3779985 (cross-site scripting, CVSS 6.1). And if you connect BTP to your system through SAP Cloud Connector, there is a low-priority fix for version 2.0, which your own team installs and maintains.
Who does what on RISE
On RISE with SAP, SAP ECS takes care of the technical layer: operating system, HANA database, kernel and Web Dispatcher. Fixes that live in ABAP code, such as those for S4CORE, SAP_BASIS or SAP_UI, are implemented on the customer side through SNOTE or a Support Package update, and that is where your Basis team comes in.
In practice this means two things. For kernel and Web Dispatcher notes, confirm with SAP ECS through your dCEM which window they will be applied in for DEV, QA and PRD. For code notes, someone on your side has to check whether they apply to your Support Package level, implement them in DEV, test and transport. Your contract may vary from this split, so it is worth having it in writing.
Outside S/4HANA, but in the bulletin
Three of the four critical notes do not touch the S/4HANA core. Review them if your landscape includes these products:
- SAP Cloud SDK for Python (note 3797111, CVSS 10.0). SSRF in OAuth2 handling, fixed in version 0.45.2. Relevant if you build BTP applications with this library.
- SAP NetWeaver Visual Composer (note 3805589, CVSS 9.9). Broken access control in VC70RUNTIME 7.50, on NetWeaver Java.
- SAP Manufacturing Integration and Intelligence (note 3800517, CVSS 9.1). Missing authorization check in the Configuration Service, XMII 15.4 and 15.5.
- Other products. SAP Commerce Cloud (CVSS 8.8), SAP NetWeaver Enterprise Portal, SAP Global Trade Services and several development libraries published on GitHub.
What to check this week
Confirm OVERPASS first. Ask your dCEM whether note 3747649 is already applied in DEV, QA and PRD. If not, confirm which window SAP ECS will use or whether your company has a risk letter exception.
Find your S4CORE version. If it is between 105 and 109, note 3798788 applies and goes first. Check in SAP for Me whether your Support Package already includes it or whether it has to be implemented with SNOTE.
Ask SAP ECS about the kernel. Confirm with your dCEM when the fix for note 3626303 will be applied and whether it needs a window with a restart in PRD.
Keep a record. Write down which notes you applied, on which systems and on what date. That log saves time in the next audit and on the next Patch Day.
Sources
- SAP Support, SAP Security Patch Day bulletin for October 2026.
- SAP Support, SAP Security Notes FAQ and calendar.
- SAP Support, SAP Security Patch Day bulletin for September 2026 (note 3747649).
- Onapsis, technical analysis of OVERPASS (CVE-2026-44756).
- Security Online, coverage of the October 2026 Patch Day.
This is the October edition of our monthly series. November's edition follows the Patch Day on Tuesday, November 10.
If you want someone to check every month which notes apply to your landscape and coordinate with SAP ECS, let's talk.