CVE-2026-34258

MEDIUM

Content Spoofing vulnerability in SAPUI5 (Search UI)

Title source: cna

Description

SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on the integrity and availability of the application.

References (2)

Core 2

Core References

https://me.sap.com/notes/3726583

https://url.sap/sapsecuritypatchday

Scores

CVSS v3 4.7

EPSS 0.0001

EPSS Percentile 3.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-451

Status published

Products (7)

SAP_SE/SAPUI5 (Search UI) 1.120

SAP_SE/SAPUI5 (Search UI) 1.136

SAP_SE/SAPUI5 (Search UI) 1.142

SAP_SE/SAPUI5 (Search UI) 1.71

SAP_SE/SAPUI5 (Search UI) 1.84

SAP_SE/SAPUI5 (Search UI) 1.96

SAP_SE/SAPUI5 (Search UI) SAPUI5 1.108

Published May 12, 2026

Tracked Since May 12, 2026