CVE-2026-66771: Cross Site Scripting (XSS) vulnerability in SAPUI5

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-24
Weakness: CWE-79

Description

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the attacker to access sensitive session data and perform unauthorized actions on behalf of the victim, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

Affected products

SAP_SE SAPUI5: SAP_UI 750, 754, 755, 756, 757, 758 (+2)

References

Get alerted when CVE-2026-66771 or the next vulnerability affects your stack