CVE-2026-66770

MediumCVSS 6.3/10Last modified Oct 24, 2026

Description

Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to the database structure, resulting in a low impact to the confidentiality, integrity, and availability of the system.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-667716.1SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When anot CVE-2026-667724.3SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative CVE-2026-667735.9A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application,CVE-2026-667743.7SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default CVE-2026-667754.3SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker coul CVE-2026-667765.9SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An CVE-2026-667775.9SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity CVE-2026-667785.3SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated at CVE-2026-667796.3Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malic CVE-2026-66785.3Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.CVE-2026-667806.5A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, posse CVE-2026-667815.4A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPse