VulnerabilityAwaiting Analysis

CVE-2026-66766

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability.

HIGH 7.5EPSS 0.29%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.29%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-1333
Source: cna@sap.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.