CVE-2026-89106

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

• CWE-183

• https://me.sap.com/notes/3799054
• https://url.sap/sapsecuritypatchday

Published

Oct 13, 2026

Last Modified

Oct 15, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89098A flaw was found in nfs-utils. The fsidd daemon improperly h…5.5
• CVE-2026-89099A race condition in the document value layer of MongoDB Serv…7.5
• CVE-2026-8910The WP Emoticon Rating plugin for WordPress is vulnerable to…6.1
• CVE-2026-89100The Payment Plugins for Stripe WooCommerce plugin for WordPr…6.1
• CVE-2026-89102In wolfSSL versions 5.7.2 through 5.9.2 there is a client-si…6.5
• CVE-2026-89105The HybridTokenAuthenticator component of the SAP/cloud-secu…4.2
• CVE-2026-89107SAP S/4HANA (Manage Substitution/Validation Rules) does not …9.9
• CVE-2026-89108SAP Manufacturing Integration and Intelligence does not suff…9.1
• CVE-2026-8911The WP AutoBuzz plugin for WordPress is vulnerable to Cross-…6.1
• CVE-2026-89110SAP NetWeaver Visual Composer does not perform sufficient au…9.9
• CVE-2026-89111The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnera…10
• CVE-2026-89112The admin API endpoint used to retrieve CLA signature record…6.5