CVE-2026-76977
Medium
Description
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the victim into performing unintended actions, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
SeverityMedium
CVSS4.3
Exploit probability—
ProductSAPUI5(Frame Options Allowlist)
PublishedSep 8, 2026
First seenSep 8, 2026
Weakness typeCWE-1289CWE-1289
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SAP_SE SAPUI5(Frame Options Allowlist) | SAP_UI 750, 754, 755, 756, 757, 758, 816, UI_700 200 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.