DOM XSS in SAP UI5 via Malicious Link
CVE-2026-76975 Published on October 13, 2026

Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)
Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper sanitization, causing attacker-supplied script to execute in the victims browser context. This could allow the attacker to access or modify information within the victims browser scope, impacting confidentiality and integrity, while availability remains unaffected.

NVD

Vulnerability Analysis

CVE-2026-76975 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-76975 has been classified to as a XSS vulnerability or weakness.


Affected Versions

SAP_SE SAPUI5 (Support Assistant Overlay) Version SAP_UI 754 is affected by CVE-2026-76975