Quick answers
- Is CVE-2026-66766 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-66766 being exploited in the wild.
- How severe is CVE-2026-66766?
- High severity, with a CVSS score of 7.5, published 25 August 2026.
- Which products and versions are affected?
- SAP S/4HANA Private Cloud.
- Is there a fix for CVE-2026-66766?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-66766 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-66766?
- Check whether you run SAP S/4HANA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in a third-party component used by SAP S/4HANA (Private Cloud). The attack is network-accessible and requires no authentication; an attacker can supply malicious input that triggers excessive processing within the affected regex pattern, exhausting system resources and causing denial of service. Successful exploitation results in high impact to service availability with no impact on confidentiality or integrity. Patches are available through SAP Security Notes; refer to SAP Note 3771065 and SAP Security Patch Day advisories for remediation guidance.
Affected products
- SAP S/4HANA Private Cloud
Timeline
- 2026-08-25: disclosed