CVE-2026-89106

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

Score

CVSS 3.1 4.4 Medium

Status

Awaiting Analysis - cna@sap.com

Published

2026-10-13

Last modified

2026-10-15

Weaknesses

CWE-183

Affected products

• Sapui5 (Sap Se)

References

• https://me.sap.com/notes/3799054
• https://url.sap/sapsecuritypatchday