CVE-2026-89106: Cross Site Scripting (XSS) vulnerability in SAPUI5
Published Oct 13, 2026
·Updated
SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.
Affected Software
1 affected component
SAP SAPUI5
Event History
Oct 13, 2026
CVE Published
via MITRE·12:23 AM
Data Sourced
via MITRE·12:23 AM
DescriptionSeverity
Data Sourced
via NVD·01:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Are all SAPUI5 deployments affected?
The issue occurs only under certain configurations. The provided information does not identify which configurations are affected.
2
What access and interaction are required for exploitation?
An attacker needs low privileges to submit specially crafted content. A victim must later render that content in their browser.
3
What is the expected security impact?
The vulnerability has low impact on confidentiality and integrity. No availability impact is reported.