CVE-2026-66766

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3771065
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) SAP S/4HANA (Private Cloud) utiliza un componente de terceros que contiene una vulnerabilidad de denegación de servicio por expresión regular (ReDoS). Un atacante no autenticado podría proporcionar una entrada especialmente diseñada que desencadene un procesamiento excesivo dentro de la funcionalidad afectada. La explotación exitosa podría agotar los recursos del sistema y dejar el servicio no disponible, lo que resultaría en un alto impacto en la disponibilidad. No hay impacto en la confidencialidad e integridad.

Information

Published : 2026-08-25 01:16

Updated : 2026-10-12 15:10

NVD link : CVE-2026-66766

Mitre link : CVE-2026-66766

CVE.ORG link : CVE-2026-66766

JSON object : View

Products Affected

No product.

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-66766", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66766", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T09:51:59.715905Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP S/4HANA (Manage Supply Protection)", "versions": [{"status": "affected", "version": "UIS4HOP1 800"}, {"status": "affected", "version": "900"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-25T01:16:37.230", "references": [{"url": "https://me.sap.com/notes/3771065", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity."}, {"lang": "es", "value": "SAP S/4HANA (Private Cloud) utiliza un componente de terceros que contiene una vulnerabilidad de denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS). Un atacante no autenticado podr\u00eda proporcionar una entrada especialmente dise\u00f1ada que desencadene un procesamiento excesivo dentro de la funcionalidad afectada. La explotaci\u00f3n exitosa podr\u00eda agotar los recursos del sistema y dejar el servicio no disponible, lo que resultar\u00eda en un alto impacto en la disponibilidad. No hay impacto en la confidencialidad e integridad."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "cna@sap.com"}