CVE-2026-66766
Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)
- State
- Published
- Severity
- 7.5 High
- Published
- Aug 25, 2026
- Updated
- Aug 25, 2026
- Reserved
- Jul 27, 2026
Description
SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | sap |
Weaknesses
- CWE-1333 Inefficient Regular Expression Complexity
Affected Products
| Product | Versions |
|---|---|
SAP S/4HANA (Manage Supply Protection)SAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.