CVE-2026-89106 — Cross Site Scripting (XSS) vulnerability in SAPUI5

CVE-2026-89106

Cross Site Scripting (XSS) vulnerability in SAPUI5 PUBLISHED

Description (CNA)

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAPUI5	affected SAP_UI 750; affected 754; affected 755; affected 756; affected 757; affected 758; affected 816; affected UI_700 200

CWE

CWE-183

References

https://me.sap.com/notes/3799054
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.