CVE-2026-89106

MediumCVSS 4.4

Published: 13/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity, with no impact on availability.

Risk Assessment

The ability to render crafted content in a victim's browser may lead to information leakage or content manipulation, though the impact is low.

Recommendation

Apply SAP updates for UI5 and implement input validation in configurations that render user content.

Other vulnerabilities in SAP UI5

CVE-2026-76977Medium
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the victim into performing unintended actions, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS