CVE-2026-89106

MEDIUMCVSS 4.4

Description

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

Timeline

Published:October 13th, 2026 1:16 AM

Last modified:October 15th, 2026 8:38 PM

CVSS Scoring

CVSS v3: 4.4 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-183

References & Reports

Advisories, patches, and third-party reports

https://me.sap.com/notes/3799054
https://url.sap/sapsecuritypatchday

Source: NIST NVD · Data may lag official sources by up to one minute