CVE-2026-66766 — Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)

CVE-2026-66766

Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection) PUBLISHED

Description (CNA)

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability. There is no impact on confidentiality and integrity.

Affected (CNA)

Vendor / product	Versions
SAP_SE / SAP S/4HANA (Manage Supply Protection)	affected UIS4HOP1 800; affected 900

CWE

CWE-1333

References

https://me.sap.com/notes/3771065
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.