Advisory
On 11.08.2026 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP UI5.
SAP Note 3772071 addresses "3772071 - [CVE-2026-66771] Cross Site Scripting (XSS) vulnerability in SAPUI5" to prevent cross-site scripting (xss) with a medium risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process, the team suggests.
Cross-site scripting (XSS) is the name of a class of security vulnerabilities that can occur in web-based
applications. XSS combines
all vulnerabilities that allow an attacker to inject HTML Markup and/or JavaScript into the front end of the
affected web application.
XSS attacks can occur whenever the application dynamically creates its HTML/JavaScript/CSS content, which is passed
to the
user's web browser, and attacker-controlled values are used in this process. If these values are included in the
generated code without proper validation and encoding, the attacker is able to include arbitrary
coding snippets into the application's front end. The code is then rendered by the victim's web browser and
interpreted in the victim's current authentication context.
Risk specification
SAPUI5 allows an authenticated attacker with content adaptation privileges to inject malicious script content into persisted application changes that, when accessed by a victim, executes in the victim's browser session, resulting in unauthorized access to session data and actions performed on behalf of the victim.
Solution
The framework's internal reference resolution mechanism now maintains a blocklist of dangerous global functions and rejects them during path resolution, with an additional context check to block indirect access through browser window objects.
The advisory is valid for
- SAP_UI 750 20
- SAP_UI 754 30
- SAP_UI 755 26
- SAP_UI 756 20
- SAP_UI 757 12
- SAP_UI 758 9
- SAP_UI 816 3
- UI_700 200 12
