SAPUI5 Support Assistant CVE-2026-76975

Exploitation requires the SAPUI5 Support Assistant Overlay component to be present/accessible, and an authenticated SAP user (UI:R) to actively open an attacker-crafted public link whose parameter is read by client-side code and written into the DOM without sanitization. The attacker needs no authentication or privileges (PR:N) to create and distribute the link, but cannot trigger execution without victim interaction - the victim must be a logged-in user, and payload execution is confined to that victim's browser context. Limiting factors: dependence on social-engineering a specific authenticated user into clicking, and no server-side or availability impact (A:N).

This is a moderate-severity DOM-based XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in SAP's SAPUI5 Support Assistant Overlay, with no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting: network vector and no attacker-side privileges (PR:N) let an unauthenticated attacker craft and host the malicious link, but exploitation hinges on required user interaction (UI:R) by an authenticated victim, which materially limits mass exploitability. No EPSS score, KEV listing, or POC availability was supplied in the input, so there is no evidence of automated or widespread exploitation - this reads as a defense-in-depth fix rather than an urgent priority. Impact is bounded to the victim's browser context (C:L/I:L, A:N), i.e. partial confidentiality and integrity loss such as session/token theft or DOM manipulation, not server compromise. Note the signals that are MISSING: without EPSS/KEV/POC data this risk rating rests entirely on the CVSS vector and description; treat the 'no exploitation' conclusion as absence-of-evidence, not confirmed-absence.

An attacker crafts a URL targeting the SAPUI5 Support Assistant Overlay that embeds malicious script in an attacker-controlled parameter, then publishes it (phishing email, forum post, chat). When an authenticated SAP user opens the link, the overlay's client-side code reads the tainted input and writes it into the DOM without sanitization, executing the script in the victim's authenticated session to steal session data or alter displayed content. No public exploit code is referenced in the available data, so a working POC would need to be developed.