SAP's Oct 13 Security Patch Day ships 16 new notes and 4 GitHub advisories. Highest severity: CVE-2026-89111 (CVSS 10.0) in SAP Cloud SDK for Python <0.45.2 — attacker-controlled tenant_subdomain can redirect OAuth2 token requests and exfiltrate client credentials in multi-tenant BTP apps. Fix: upgrade to 0.45.2+; workaround: allowlist tenant subdomains. Also Critical: NetWeaver Visual Composer broken access control (CVE-2026-89110, 9.9) and S/4HANA Manage Substitution/Validation Rules code injection (CVE-2026-89107, 9.9).