CVE-2026-66766

HighCVSS 7.5/10Last modified Oct 12, 2026

Description

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Oct 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-667677.7SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers CVE-2026-667689.0SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-priv CVE-2026-667706.3Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definitio CVE-2026-667716.1SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When anot CVE-2026-667724.3SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative CVE-2026-667735.9A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application,CVE-2026-667743.7SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default CVE-2026-667754.3SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker coul CVE-2026-667765.9SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An CVE-2026-667775.9SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity CVE-2026-667785.3SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated at CVE-2026-667796.3Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malic