Security Advisory: PHP CVE-2026-109618 and CVE-2026-109619 — enosix Solutions Not Affected​

Two vulnerabilities have been published in the National Vulnerability Database: CVE-2026-109618 and CVE-2026-109619.

enosix solutions are not affected.​

enosix does not use PHP in any of our solutions, so neither CVE applies to our products.

If you have questions or concerns, please reach out to the enosix team.

For full details on these vulnerabilities, see the NVD entries for CVE-2026-109618 and CVE-2026-109619.

New Features & Improvements​

• Improved VC session management Cloud UI now manages VC sessions more consistently across processing and recovery. This helps avoid unnecessary SAP session use and reduce resource consumption, particularly when users work across browser tabs.

• Include the API specification in generated projects Generated Cloud UI template projects now include the current CloudUI_OAS.json by default at /api-spec/CloudUI_OAS.json after build and deployment. You can opt out of including the specification in the CLI wizard when you want a smaller project.

• Select SAP sales header values from dropdowns Sales Office, Sales Group, and Sales District are now selectable dropdowns populated with SAP values and descriptions. Users can choose and change these values when creating or updating a sales document.

Bug Fixes​

• Navigate all VC characteristic groups When a product has more characteristic groups than fit in the tab bar, navigation controls let you reach every group without changing browser zoom.

• Material Quick Add accepts lowercase input You no longer need to manually capitalize material searches. Cloud UI automatically capitalizes your input before searching SAP.

• Item-level conditions remain when header conditions change Editing and simulating header conditions no longer clears conditions saved on individual items. Item-level pricing adjustments remain visible when you return to the item.

• Incompletion notifications reflect outstanding requirements Incompletion notifications now match SAP and Transact behavior across sales document apps, helping users identify the requirements that still need attention.

• Custom app toast notifications display correctly Custom apps using Cloud UI's toast-message hook can now display notifications through their app's notification provider. When upgrading an existing app to 10.x, follow the 9.x to 10.x upgrade guide to add the required notistack dependency.

🚀 arnold™ 1.3.1​

• NA Release Date: 2026-10-12
• EU Release Date: 2026-10-15

arnold™ 1.3.1 expands connection and custom tool capabilities, introduces richer MCP UI experiences, and strengthens security, reliability, and platform administration.

🔗 Expanded Connection Management​

What it is​

arnold now supports Generic REST API connections, allowing custom tools to connect to HTTP endpoints beyond standard SAP connection scenarios with configurable authentication.

Connection handling has also been standardized across API Key, Basic Auth, and OAuth, with timeout protection added to prevent requests from hanging indefinitely.

Why it matters​

• Connect custom tools to a broader range of APIs and services
• Use flexible authentication options
• More consistent connection behavior
• Improved protection from unresponsive endpoints

🖥️ Richer MCP UI Experiences​

What it is​

Custom tools can now use MCP UI Resource Templates to return interactive HTML experiences in supported AI clients. Templates use Liquid-based configuration and run with restricted functionality for safer rendering. Cloud UI resources are also now proxied through arnold for more centralized management and security.

Why it matters​

• Go beyond text-only MCP responses
• Build richer, interactive experiences for AI users
• Centrally manage UI resources through arnold
• Maintain security controls around rendered content

🛠️ More Powerful Custom Tools​

What it is​

Custom tools now support output schemas, allowing admins to define the expected JSON structure returned by a tool. Input schemas can also define enum values to restrict fields to approved options. Tool execution handling has also been improved with better response validation and clearer errors.

Why it matters​

• More predictable structured responses
• Better control over allowed tool inputs
• Easier integration with AI clients
• Faster troubleshooting when tool execution fails

🔐 Security & Tenant Protection​

What it is​

This release includes a critical security vulnerability patch and strengthens tenant handling during Salesforce Agentforce OAuth authentication. Tenant context is now preserved during OAuth client selection to prevent cross-tenant authentication issues. Webhook retry handling has also been corrected to prevent duplicate headers during repeated requests.

Why it matters​

• Stronger platform security
• Improved tenant isolation
• More reliable Agentforce authentication
• Safer webhook processing

🔍 Improved Logging & Reliability​

What it is​

Logging and retrieval have been enhanced for better troubleshooting and audit visibility. Web job log cleanup has also been corrected to properly remove accumulated logs.

Why it matters​

• Better troubleshooting
• Cleaner operational logs
• Improved audit visibility
• More reliable background processing

[Bug Fix]: Fixed error on API Proxy RFC API call: Unknown field iindex

• This release removes the iindex attribute from the RFC calls of the API Proxy. This is not required for the execute operation of RFC API calls.

[Bug Fix]: Session-id header support added to API proxy login operation

• This release of Link adds support for the session-id header on the API proxy login operation. This enables the Link API proxy login operation to maintain or close the correct SAP session using the keep and end session header values.

[Feature]: Swagger UI on Proxies

• enosix Link Proxies can now be configured with Swagger UI to test calls to login and RFC_GET_SAP_SYSTEM_PARAMETERS directly from the Link instance. This is another tool that can be used while debugging authentication and SSO related issues. Detailed documentation can be found here: Swagger UI

The enosix team is has tested to ensure compatibility of the latest enosix apps with the Salesforce Winter ‘27 release.

Testing Highlights​

• Regression Testing:

  • Tests were executed to validate functionality and compatibility.

• Products Tested:

  • Sync for Salesforce v1.3.5
  • Surface v2.10.0
  • SDK v1.7
  • Link v6.8.6
  • Mobile App Compatibility

Testing Scope and Outcomes​

1. Sync for Salesforce v1.3.5:

• Validated real-time data synchronization between Salesforce and SAP.
• Ensured consistent performance across core use cases, including object synchronization and data accuracy.

2. Surface v2.10.0

• Confirmed compatibility with the Salesforce Sales app.
• Verified Lightning components function in the Salesforce Mobile app.

3. SDK v1.7 + Cloud-UI:
   • Verified the ability to configure a material/product and update the price on a quote line item using Cloud-UI in CPQ.

Results​

• Compatibility Confirmed: All tested products are fully compatible with Salesforce Winter ‘27.
• No Critical Issues Identified: Testing revealed no blockers or critical issues.

The enosix team remains committed to ensuring our solutions deliver seamless integration and superior performance. For any questions or support, please contact our team.

Support portal: https://go.enosix.com/support

New Features & Improvements​

• Create sales documents from an existing document When launching Sales Document UI in Create mode, you can provide a reference document to pre-populate a new Order or Quote with its header, partners, conditions, texts, and items. Saving creates a new SAP document; it does not change the source document. Create mode without a reference document is unchanged.

• Control header values when updating a sales document The mapUpdateFromSObject setting can now apply host-provided values to changeable header fields when an existing SAP sales document is opened in Update mode. SAP values are retained for Sold-to Party, Document Type, and Sales Area fields. When the setting is off, SAP header values remain unchanged. This setting does not overlay item fields.

Bug Fixes​

• Customer address now populates partner address overrides Fixed an issue where autoPopulateAddressOverrideFromCustomer could leave address override fields empty. When enabled, it now fills an initially empty partner address override with the current sales document customer's address.

Security Improvements​

• Dependency security improvements This release includes various security improvements to Cloud UI and supporting components through dependency updates and improved monitoring for future updates.

🚀 arnold™ 1.2.0​

• NA Release Date: 2026-09-28
• EU Release Date: 2026-10-01

arnold™ 1.2.0 improves group-based access controls, Cloud UI app management, custom tool configuration, and audit tracking. It also provides better visibility into which MCP clients are using the newer MCP version.

👥 Stronger Group-Based Access Controls​

What it is​

Group management now provides more precise access controls for connections and MCP requests. Connection visibility is filtered according to user role, group ownership, and client access. MCP requests are checked against tenant and client group membership when group management is enabled.

Why it matters​

• Helps ensure users see only the connections available to them
• Enforces group membership checks for MCP access
• Gives administrators and regular users access appropriate to their roles

☁️ Cloud UI App Import & Export​

What it is​

Cloud UI app configurations can be imported and exported, with validation and audit tracking for import operations.

Why it matters​

• Makes it easier to reuse and transfer app configurations
• Helps catch issues during configuration import
• Improves traceability of configuration changes

🧰 More Reliable Custom Tool Configuration​

What it is​

Custom tool templates are checked for syntax issues before they are saved. Configuration references in templates and scripts now report errors when values are missing or unassigned.

Why it matters​

• Helps identify template problems before a tool is used
• Makes missing configuration easier to diagnose
• Reduces unexpected behavior caused by incomplete settings

🔎 Improved Audit Tracking​

What it is​

Audit tracking has been expanded for language model and feature changes, with improvements to change details and user identification.

Why it matters​

• Provides clearer records of important configuration changes
• Makes it easier to understand who made a change and what was affected
• Supports troubleshooting and operational oversight

🐞 Bug Fixes & Stability​

What it is​

This release fixes an issue that could create duplicate tenants when concurrent consent callbacks were processed. It also improves configuration handling and audit-log behavior, as well as better analytics for tracking client MCP versions.

Why it matters​

• Prevents duplicate tenant records caused by concurrent requests
• Keeps audit information within the correct tenant context
• Makes configuration errors clearer and easier to resolve

Security Improvements​

• Security vulnerability remediation and CI guardrails Resolved existing security vulnerabilities in the Cloud UI codebase and added CI pipeline enforcement so newly detected security issues block progress. This helps prevent insecure dependency or code changes from being promoted.

Bug Fixes​

• Sales-area dependent fields now reset correctly on Sales Organization change Fixed an issue where SalesOffice, SalesOfficeName, SalesGroup, and SalesGroupName could retain old values after changing Sales Organization. These fields now clear and repopulate correctly based on the newly selected sales area.

• Context text field values now appear when editing items Fixed an issue where item text field values provided through Context were not displayed in the item edit experience. Values are now shown correctly when the item is opened for editing.

Get it here: v9.6.54

[Bug Fix]: MultiAuthenticationEnabled Flag removed

• This release removes the MultiAuthenticationEnabled flag from the api proxy configuration. This flag was previously used to enable or disable the multi-authentication feature, but it is no longer necessary and has been removed. Swagger UI follows API Proxy configuration, and this flag is not required anymore.

For more information, here is the updated documentation Swagger UI

🚀 arnold™ 1.1.2​

• NA Release Date: 2026-09-14
• EU Release Date: 2026-09-18

arnold™ 1.1.2 improves Client App management, MCP client compatibility, tool customization, logging, and OAuth troubleshooting.

📱 Improved Client App Management​

What it is​

The Client Apps experience has been redesigned with a unified management page, searchable client list, and improved navigation.

Why it matters​

• Easier Client App administration
• Faster search and navigation
• More streamlined configuration workflows

🔌 Smarter MCP Client Compatibility​

What it is​

arnold now recognizes MCP client capabilities and adjusts available tools and response formats accordingly. UI-specific tools are only exposed to clients that support MCP Apps, while structured output can be controlled per Client App. Client capability information is also retained throughout the MCP session, including resumed sessions.

Why it matters​

• Better compatibility across different AI clients
• Prevents unsupported UI tools from being exposed
• More reliable structured data handling
• More consistent behavior throughout MCP sessions

🛠️ Improved Custom Tool Management​

What it is​

Customizing a previously deactivated tool now reactivates the existing tool instead of creating a duplicate. MCP App tool names have also been standardized using snake_case.

Why it matters​

• Cleaner tool configuration
• Fewer duplicate tools
• More consistent MCP tool definitions

🔍 Improved Logging & Audit Tracking​

What it is​

Logging has been enhanced with more consistent user identification and Client App retrieval. Connection IDs are now included in connection test logs for API Key and Basic Authentication.

Why it matters​

• More reliable user activity tracking
• Better audit records
• Easier connection troubleshooting