CVE-2026-76975: Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)
Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper sanitization, causing attacker-supplied script to execute in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Authenticated users who can be induced to open an attacker-controlled malicious link are exposed. The attacker does not need authentication, but exploitation requires victim interaction.
What access does an attacker need?
The attacker can be unauthenticated and can exploit the issue remotely by creating and publicly sharing a malicious link. Successful exploitation depends on an authenticated user visiting that link.
What is the impact if exploitation succeeds?
Attacker-supplied script executes in the victim's browser context and may access or modify information available within that browser scope. Confidentiality and integrity may be affected; availability is not affected.