SAP warns of maximum severity OAuth2 SSRF security flaw

SAP released its October 2026 security updates addressing 20 security vulnerabilities across multiple products. The most critical flaw is a maximum-severity Server-Side Request Forgery (SSRF) vulnerability found in the Cloud SDK for Python, specifically in its OAuth2 implementation. The vulnerability received the highest possible severity rating, indicating significant risk to affected systems. Organizations using SAP Cloud SDK for Python are urged to apply the patches immediately. The update cycle also covers a range of other SAP products with varying severity levels. SSRF vulnerabilities can allow attackers to make the server send requests to unintended internal or external resources, potentially exposing sensitive data or enabling further attacks. SAP has not disclosed whether the vulnerability is being actively exploited in the wild. Customers are advised to consult SAP's official security portal for detailed patch guidance.