# CVE-2026-66766: SAP S/4HANA ReDoS in third-party component

Source: https://junglewise.ai/threats/cve-2026-66766-sap-s-4hana-redos-in-third-party-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-66766 · Severity: high · CVSS 7.5 · Published 2026-08-25

SAP S/4HANA (Private Cloud) relies on a third-party software component with a Regular Expression Denial of Service (ReDoS) vulnerability. An attacker without authentication can send specially crafted input that causes the system to consume excessive computational resources, making the service unavailable to legitimate users. This directly impacts business continuity and availability of critical ERP functionality.

Technologies: [SAP S/4HANA](https://junglewise.ai/threats/technologies/s-4hana). Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-66766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66766 being exploited in the wild.

**How severe is CVE-2026-66766?** High severity, with a CVSS score of 7.5, published 25 August 2026.

**Which products and versions are affected?** SAP S/4HANA Private Cloud.

**Is there a fix for CVE-2026-66766?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66766 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-66766?** Check whether you run SAP S/4HANA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in a third-party component used by SAP S/4HANA (Private Cloud). The attack is network-accessible and requires no authentication; an attacker can supply malicious input that triggers excessive processing within the affected regex pattern, exhausting system resources and causing denial of service. Successful exploitation results in high impact to service availability with no impact on confidentiality or integrity. Patches are available through SAP Security Notes; refer to SAP Note 3771065 and SAP Security Patch Day advisories for remediation guidance.

## Affected products

- SAP S/4HANA Private Cloud

## Timeline

- 2026-08-25: disclosed

## References

- [https://me.sap.com/notes/3771065](https://me.sap.com/notes/3771065)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP S/4HANA authorization bypass in business object modification](https://junglewise.ai/threats/cve-2026-89121-sap-s-4hana-does-not-perform-sufficient-instance-level)
- [SAP S/4HANA code injection in substitution/validation rules](https://junglewise.ai/threats/cve-2026-89107-sap-s-4hana-manage-substitution-validation-rules-does-not)
- [SAP S/4HANA authorization bypass in Manage Bank Chains app](https://junglewise.ai/threats/cve-2026-76962-sap-s-4hana-authorization-bypass-in-manage-bank-chains-app)
- [SAP S/4HANA SQL injection in Intercompany Matching and Reconciliation](https://junglewise.ai/threats/cve-2026-44766-sap-s-4hana-sql-injection-in-intercompany-matching-and)
- [SAP S/4HANA authorization bypass in Bank Statement reprocessing](https://junglewise.ai/threats/cve-2026-66764-sap-s-4hana-authorization-bypass-in-bank-statement-reprocessing)