CVE-2026-66766

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66766", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-07-27T17:33:40.733Z", "datePublished": "2026-08-25T01:08:36.749Z", "dateUpdated": "2026-08-25T09:52:18.316Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-08-25T01:08:36.749Z"}, "title": "Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP S/4HANA (Manage Supply Protection)", "versions": [{"status": "affected", "version": "UIS4HOP1 800"}, {"status": "affected", "version": "900"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3771065"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T09:51:59.715905Z", "id": "CVE-2026-66766", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T09:52:18.316Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66766", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T09:51:59.715905Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T09:52:13.629Z"}}], "cna": {"title": "Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP S/4HANA (Manage Supply Protection)", "versions": [{"status": "affected", "version": "UIS4HOP1 800"}, {"status": "affected", "version": "900"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3771065"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-08-25T01:08:36.749Z"}}}, "cveMetadata": {"cveId": "CVE-2026-66766", "state": "PUBLISHED", "dateUpdated": "2026-08-25T09:52:18.316Z", "dateReserved": "2026-07-27T17:33:40.733Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-08-25T01:08:36.749Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP S/4HANA (Manage Supply Protection)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "UIS4HOP1 800"}, {"status": "affected", "version": "900"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity."}, {"lang": "es", "value": "SAP S/4HANA (Private Cloud) utiliza un componente de terceros que contiene una vulnerabilidad de denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS). Un atacante no autenticado podr\u00eda proporcionar una entrada especialmente dise\u00f1ada que desencadene un procesamiento excesivo dentro de la funcionalidad afectada. La explotaci\u00f3n exitosa podr\u00eda agotar los recursos del sistema y dejar el servicio no disponible, lo que resultar\u00eda en un alto impacto en la disponibilidad. No hay impacto en la confidencialidad e integridad."}], "id": "CVE-2026-66766", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66766", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T09:51:59.715905Z", "version": "2.0.3"}}]}, "published": "2026-08-25T01:16:37.230", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3771065"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "UIS4HOP1 800"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "900"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SAP S/4HANA (Manage Supply Protection)", "source": "cna", "vendor": "SAP_SE"}, "product": "sap_s/4hana_(manage_supply_protection)", "vendor": "sap_se"}], "created": "2026-08-25T02:30:03.346477+00:00", "updated": "2026-08-28T20:38:33.487922+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_s/4hana_(manage_supply_protection)"]}