SAP UI5 CVE-2026-89106

Exploitation requires (1) an authenticated account with at least low privileges in the SAPUI5 application (PR:L), (2) the application running in one of the 'certain configurations' where input validation is insufficient - this is explicitly a non-default/configuration-dependent condition per the description and the AC:H rating, and (3) a victim user actively opening or rendering the view containing the attacker-supplied content (UI:R). These conditions - required authentication, a specific vulnerable configuration, and mandatory victim interaction - substantially limit realistic exploitation and make opportunistic or automated attacks impractical. The exact vulnerable configuration/feature is not named in the available description and should be confirmed against SAP Note 3799054.

This is a moderate, authenticated client-side injection issue (CWE-183, content rendered in a victim's browser - consistent with stored/reflected XSS behavior), rated CVSS 4.4 (Medium). The provided CVSS vector (AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) tells a consistent story that argues AGAINST treating this as a top priority: although network-reachable (AV:N), it requires attacker authentication (PR:L - low privileges), depends on specific non-default configurations and difficult-to-meet conditions (AC:H), and critically requires victim user interaction (UI:R) to render the malicious content. The scope change (S:C) reflects that the injected content executes in the victim's browser context rather than only the attacker's. Impact is limited to low confidentiality and low integrity (C:L/I:L) with no availability impact (A:N). No EPSS score, KEV listing, or public POC was supplied, so exploitation likelihood signals are all absent rather than low - meaning there is no evidence of active or probable near-term exploitation, but also no quantitative probability to cite. Net: this is a legitimate but low-urgency finding - high CVSS is not in play (score is Medium), and the combination of AC:H + PR:L + UI:R makes opportunistic mass exploitation unlikely; patch on a normal SAP Security Patch Day cadence rather than emergency.

A low-privileged authenticated user of an SAPUI5-based application submits specially crafted content into a field that is insufficiently validated under a vulnerable configuration. When a higher-privileged victim later opens the view containing that content, it is rendered in their browser and executes in the application context, allowing limited disclosure or manipulation of data visible to that session. No public exploit code was identified at time of analysis.