CVE-2026-89106

CVSS 4.4 (medium) · published 2026-10-13

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

Weakness: CWE-183

Source: NVD CVE-2026-89106

References

• https://me.sap.com/notes/3799054
• https://url.sap/sapsecuritypatchday

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.