CVE-2026-89106: SAP SE SAPUI5

Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days.

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

Affected products

• SAP SE SAPUI5: version 754 only; version 755 only; version 756 only; version 757 only; version 758 only; version 816 only

Published 2026-10-13. Last modified 2026-10-15.