CVE-2026-89106: Cross Site Scripting (XSS) vulnerability in SAPUI5

Published Oct 13, 2026

Updated

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

Affected Software

1 affected component

SAP SAPUI5

Event History

Oct 13, 2026

CVE Published

via MITRE·12:23 AM

Data Sourced

via MITRE·12:23 AM

DescriptionSeverity

Data Sourced

via NVD·01:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Are all SAPUI5 deployments affected?

The issue occurs only under certain configurations. The provided information does not identify which configurations are affected.

What access and interaction are required for exploitation?

An attacker needs low privileges to submit specially crafted content. A victim must later render that content in their browser.

What is the expected security impact?

The vulnerability has low impact on confidentiality and integrity. No availability impact is reported.

CVE-2026-89106: Cross Site Scripting (XSS) vulnerability in SAPUI5

Affected Software

Event History

Frequently Asked Questions

Are all SAPUI5 deployments affected?

What access and interaction are required for exploitation?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Are all SAPUI5 deployments affected?

What access and interaction are required for exploitation?

What is the expected security impact?