CVE-2026-66766CWE-1333

CVE-2026-66766

High · published August 25, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00509 · 42.6th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2026-08-25T05:16Z
References (2)
https://me.sap.com/notes/3771065 · [email protected]https://url.sap/sapsecuritypatchday · [email protected]
EPSS history
Timeline
  • 26 AUG 08:22Z
    EPSS moved — → 0%
    epss
  • 25 AUG 01:08Z
    Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)
    cvelistv5