CVE-2026-76975 · CVSS 3.0 6.1 · SAP Note 3794572
CVE-2026-76975 is a DOM-based XSS issue in the SAPUI5 Support Assistant Overlay. An attacker-controlled URL parameter can reach the page without adequate encoding. The victim needs an active SAP session and must open the malicious content.
No attacker account is required
SAP assigns CVSS 6.1 and Medium priority. The attacker can prepare the link without authentication; user interaction is still required for exploitation. Script execution takes place in the victim’s browser context, with confidentiality and integrity impacts. SAP reports no availability impact.
The fixed 1.71 branch
The note lists SAP_UI 754 and identifies SAPUI5 1.71.85 or higher as the corrected patch level. The fix encodes the affected URL parameter. The manual activity points to SAP Note 3155948 for the UI5 patch update procedure. Check the UI5 runtime that the affected application actually loads, not just the version recorded in a deployment plan.
Coordinate the two October UI5 notes
The same 1.71.85 minimum appears for the 1.71 branch in Note 3799054, the separate URLListValidator advisory. The issues have different preconditions and different root causes, even when a single UI5 update addresses both. Track both notes in the remediation record. After deployment, test normal Support Assistant use and the application’s usual navigation with an authenticated test account.
Advisory details
Component: CA-UI5-CTR-ROD
SAP priority: Correction with medium priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: SAP Security Note 3794572 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
