CVE-2026-89106

4.4Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.4Medium

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-183

Impact

Low-privileged attackers can execute client-side scripts in a victim's browser if the victim views specially crafted content. They need network access to the application, valid low-level credentials, and user interaction.

Root cause

SAP UI5 fails to properly validate and sanitize user input before rendering it in certain UI configurations.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Apply the patch documented in SAP Security Note 3799054 via the SAP Support Portal; no interim mitigation or workaround is provided in the advisory.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-89106