CVE-2026-89106
Received Received - Intake

Insufficient Input Validation in SAP UI5 Leading to XSS

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: SAP SE

Description
SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-89106
EUVD
EUVD-2026-98189

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
SAP_SE SAPUI5 SAP_UI 750
SAP_SE SAPUI5 754
SAP_SE SAPUI5 755
SAP_SE SAPUI5 756
SAP_SE SAPUI5 757
SAP_SE SAPUI5 758
SAP_SE SAPUI5 816
SAP_SE SAPUI5 UI_700 200

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-183 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP UI5 fails to properly validate user input in certain setups. An attacker with limited access could craft malicious content that gets executed in a victim's browser when rendered. This is a cross-site scripting (XSS) risk due to insufficient input sanitization.

Detection Guidance

Detecting this vulnerability requires checking for improper input validation in SAP UI5 configurations. Review server logs for unusual requests containing crafted content. Inspect browser-rendered pages for unexpected scripts or payloads. Use network monitoring tools to identify low-privilege user submissions that trigger rendering issues.

Impact Analysis

If exploited, this could allow attackers to steal session cookies, perform actions on your behalf, or deface web interfaces. The impact is limited to confidentiality and integrity but requires user interaction (victim must view crafted content).

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements for safeguarding sensitive information. Organizations must address it to maintain compliance.

Mitigation Strategies
  • Apply SAP's official patch or update for SAP UI5 as referenced in SAP Note 3799054.
  • Configure input validation rules to reject or sanitize specially crafted content before rendering.
  • Restrict low-privilege user permissions to limit potential exploitation vectors.
  • Monitor and log user submissions for suspicious activity patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89106. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart