SBA Research is a research center for Information Security funded partly by the national initiative for COMET Competence Centers for Excellent Technologies.
Our colleagues Gregor Roschitz (HR) and Jeanine Lefévre (Office of Equal Opportunities) participated in a high-level diversity event organized by CSR Circle, HR Circle, and the Diversity Think Tank in Vienna in mid-May. Both returned with valuable insights and practical new approaches that will help strengthen the ongoing diversity work at SBA Research. Read More
Sebastian Schrittwieser, key researcher at SBA Research and head of the CD-Lab AsTra and Johanna Ullrich, key researcher at SBA Research and Professor of Security at IT:U, received the Best Paper Award at the AgentSkills Workshop at the ACM Conference on AI and Agentic Systems (CAIS 2026) in San José for their work Context Matters: Repository-Aware Security Analysis of the Agent Skill Ecosystem. Read More
On 20–21 May 2026, SBA Research had the pleasure of hosting the ERCIM Spring Meeting at our offices in Vienna. Representatives from ERCIM member institutions across Europe came together for two days of exchange, strategic discussions, and collaborative planning focused on the future of European research in informatics and mathematics. Read More
Our colleague Andreas Ekelhart, key researcher and Applied Research Lead at SBA Research and researcher at the Research Group Security & Privacy at University of Vienna,, presented his conference paper titled AgentO: An Ontology for Modeling Agentic AI Systems at the 23rd European Semantic Web Conference (ESWC 2026) in Dubrovnik, Croatia. Read More
Our colleague Sebastian Raubitzek, researcher at SBA Research and a member of the Security and Privacy Research Group at the University of Vienna, has published a journal article titled “Fractals in Neural Networks: Introducing a New Class of Activation Functions” in Communications in Nonlinear Science and Numerical Simulations in collaboration with the CD lab AsTra. Read More
Users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Read More
The IRIS web application is vulnerable to a Cross-site request forgery attack, because it uses the HTTP method GET to change state on the server. Read More
The IRIS web application does not properly validate uploaded files. It can therefore be misused to host phishing pages, amongst other things. This also creates an instance of a Cross-Site Scripting (XSS) vulnerability. Read More
New paper “Send and Pretend: Exploiting Transcript Consistency Issues in End-to-End Encrypted Group Chats”, was recently accepted for the 35th USENIX Security Symposium. The paper is a collaboration between SBA, the University of Vienna, and the Interdisciplinary Transformation University Austria (IT). It was authored by Gabriel K. Gegenhuber, Moritz Grefner, Maximilian Günther, Matthäus Wininger, David Schmidt, and Aljosha Judmayer. ∞
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets (CVE-2026-16969), custom attributes (CVE-2026-18360) and datastore upload (CVE-2026-18361) functions. ∞
We are proud to celebrate the outstanding achievements of our researchers, who were recognized at the University of Vienna Faculty of Computer Science's Best-of-the-Best Awards on June 24. ∞