SAP SE SAPUI5 vulnerabilities

3 CVEs affecting SAP SE SAPUI5, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-89106, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-66771, published 2026-08-11. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the…
CVE-2024-33007, published 2024-05-14. Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days. PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side…
CVE-2026-89106, published 2026-10-13. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser.…