CVE-2026-66771 Overview
CVE-2026-66771 is a stored cross-site scripting (XSS) vulnerability in SAPUI5. A key user with content adaptation privileges can inject malicious script content into persisted application changes. When another user later opens the adapted application, the injected script executes in the victim's browser session under the victim's context.
The flaw is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Successful exploitation exposes session data and enables unauthorized actions on behalf of the victim. Availability is not affected.
Critical Impact
An authenticated key user can persist malicious scripts inside SAPUI5 application adaptations, causing script execution in other users' browsers and leading to session compromise and unauthorized actions.
Affected Products
- SAPUI5 (SAP Note #3772071 lists affected versions)
- SAP applications leveraging SAPUI5 content adaptation features
- SAP Fiori applications built on affected SAPUI5 releases
Discovery Timeline
- 2026-08-11 - CVE-2026-66771 published to the National Vulnerability Database (NVD)
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-66771
Vulnerability Analysis
CVE-2026-66771 is a stored XSS vulnerability affecting the SAPUI5 content adaptation workflow. SAPUI5 permits key users to modify and persist application changes through content adaptation. These persisted changes are rendered to other users when they open the adapted application.
The framework does not adequately neutralize script content submitted through the adaptation interface. Malicious markup or JavaScript stored as part of an application change is later reflected into the DOM of downstream users. The script executes with the privileges and session context of the victim.
The attack requires network access, high privileges (a key user with content adaptation rights), and user interaction from a victim who opens the adapted application. Because the payload is persisted, a single injection can compromise every subsequent user of the affected application.
Root Cause
The root cause is improper output encoding and input sanitization of user-controlled content inside persisted SAPUI5 application changes. Content adaptation data is treated as trusted markup rather than escaped when serialized back into the rendered UI. This aligns with the CWE-79 pattern for stored XSS in web frameworks.
Attack Vector
An attacker with key user permissions and content adaptation privileges opens the SAPUI5 application in adaptation mode. The attacker inserts a crafted payload into a UI element or property that accepts free-form content, then saves the change. The malicious payload is persisted to the backend as part of the application variant.
When a second user opens the adapted application, SAPUI5 loads the stored variant and renders the injected content. The script executes in that user's browser session, allowing the attacker to exfiltrate session tokens, read sensitive DOM content, and issue requests as the victim.
No public proof-of-concept has been released. The SAP Note #3772071 contains vendor technical details for authorized customers.
Detection Methods for CVE-2026-66771
Indicators of Compromise
- Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored inside SAPUI5 application variant payloads or LREP (Layered Repository) change files.
- Outbound HTTP requests from user browsers to unfamiliar domains shortly after opening SAP Fiori or SAPUI5 applications.
- Content adaptation activity logged for key user accounts that do not typically perform adaptations.
Detection Strategies
- Inspect persisted SAPUI5 change objects in the LREP for HTML or JavaScript patterns using vendor-supported queries described in SAP Note #3772071.
- Review SAP audit logs for content adaptation save events correlated with key user accounts and compare against approved change windows.
- Deploy a Content Security Policy (CSP) in report-only mode to surface unexpected inline script execution inside Fiori launchpad sessions.
Monitoring Recommendations
- Forward SAP application, audit, and web dispatcher logs to a centralized analytics platform and alert on adaptation events from non-standard users.
- Monitor browser telemetry for anomalous DOM manipulation and outbound connections originating from SAPUI5 origins.
- Track privileged role assignments granting content adaptation rights and alert on new grants.
How to Mitigate CVE-2026-66771
Immediate Actions Required
- Apply the SAPUI5 patches referenced in SAP Note #3772071 as published on the SAP Security Patch Day portal.
- Audit all accounts holding key user or content adaptation privileges and revoke rights not required for business operations.
- Review persisted application changes created before the patch date for unauthorized script content and remove suspicious variants.
Patch Information
SAP has released fixes documented in SAP Note #3772071. Customers must authenticate to the SAP ONE Support portal to obtain the note and version-specific patch details. Additional cross-referenced advisories are published on the SAP Security Patch Day landing page.
Workarounds
- Restrict content adaptation privileges to a minimal set of trusted administrators pending patch deployment.
- Enforce a strict Content Security Policy on Fiori launchpad and SAPUI5 origins to limit inline script execution.
- Require peer review and change approval workflows before publishing SAPUI5 application variants to production users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
