---
id: CVE-2026-66766
title: >-
  SAP S/4HANA (Private Cloud) uses a third-party component that contains a
  Regular Expression Denial of Service (ReDoS) vulnerability
summary: >-
  SAP S/4HANA (Private Cloud) uses a third-party component that contains a
  Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated
  attacker could supply specially crafted input that triggers excessive
  processing with…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1333
published: '2026-08-25'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:10:00.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66766'
references:
  - url: 'https://me.sap.com/notes/3771065'
    label: cna@sap.com
  - url: 'https://url.sap/sapsecuritypatchday'
    label: cna@sap.com
tags:
  - nvd
epss: 0.00509
epssPercentile: 0.41748
ingestedAt: '2026-10-12T15:55:08.142Z'
---

## Overview

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.