CVE-2026-89106 PUBLISHED

Cross Site Scripting (XSS) vulnerability in SAPUI5

Assigner: sap
Reserved: 10.09.2026 Published: 13.10.2026 Updated: 13.10.2026

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS Score: 4.4

Product Status

Vendor SAP_SE
Product SAPUI5
Versions Default: unaffected
  • Version SAP_UI 750 is affected
  • Version 754 is affected
  • Version 755 is affected
  • Version 756 is affected
  • Version 757 is affected
  • Version 758 is affected
  • Version 816 is affected
  • Version UI_700 200 is affected

References

Problem Types