medium2026-10-13SAPUI5 — Support Assistant OverlayCVE-2026-76975
DOM-Based XSS in SAPUI5 Support Assistant Overlay
SAPUI5
Our Take
Support Assistant is a diagnostic tool, so check whether it is even enabled in production. Disabled is a decent compensating control.
Vulnerability Detail
DOM-based cross-site scripting in the Support Assistant overlay.
Patch Action
Apply SAP Note 3794572 and confirm which UI5 versions you run.
Affected Versions
SAP_UI 754 (minimum 1.71.85)
Patch Info