CVE-2026-66771: sap_se sapui5 Cross-site Scripting

Vulnerability summary

CVE-2026-66771 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in sap_se sapui5. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.9% of scored vulnerabilities.

Timeline

1. 11-08-2026
   PublishedVulnerability first disclosed.
2. 11-08-2026
   Last modifiedVulnerability information updated.

Description

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the attacker to access sensitive session data and perform unauthorized actions on behalf of the victim, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.