CVE-2026-34258
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In SAPUI5 (Search UI), an unauthenticated attacker can manipulate specific URL parameters in the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on integrity and availability.
Risk Assessment
An attacker can trick users into visiting malicious pages rendered by the application, potentially leading to phishing or information leakage. The confidentiality impact is low but may erode user trust.
Recommendation
Apply SAP patches for SAPUI5 Search UI. Consider validating URL parameters and educating users about suspicious links.
Other vulnerabilities in SAPUI5
See all- CVE-2026-66771Medium
SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session.
- CVE-2026-44767Medium
The setThemeRoot() function fails to enforce the sap-allowed-theme-origins allowlist. An attacker can store and use a controlled absolute cross-origin URL to construct a <link rel=stylesheet> element, even without the <meta name=sap-allowed-theme-origins> tag. The bypass is also reachable via the ?sap-themeRoot URL parameter.
Original NVD description (English source)
SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on the integrity and availability of the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS