cyfenced.com →

[ CVE-2026-89105 · Published 13 Oct 2026 ]

Vulnerability in SAP_SE SAP/cloud-security-services-integration-library

CVSS 4.2 EPSS <1%2 agency advisoriesNo fix listed yet

[ Description ]Official description

The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1300

    Multiple vulnerabilities in SAP products Translated from French

    Multiple vulnerabilities have been discovered in SAP products. Some of them allow an attacker to cause remote arbitrary code execution, a breach of data confidentiality and SQL injection (SQLi).

    CVE-2025-42938CVE-2026-89120CVE-2026-89116+19 more CVEs
  • BSI CERT-BundWID-SEC-2026-3888

    SAP Patch Day Oktober 2026: Multiple vulnerabilities Translated from German

    CVE-2026-76972CVE-2026-89110CVE-2026-24316+19 more CVEs

[ References ]References