CVE-2026-66764
published 2026-08-11CVE-2026-66764: Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.28%
20.4th percentile
Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap_se | sap_s_4_hana | — | — |
| sap_se | sap_s_4_hana | — | — |
| sap_se | sap_s_4_hana | — | — |
| sap_se | sap_s_4_hana | — | — |
| sap_se | sap_s_4_hana | — | — |
| sap_se | sap_s_4_hana | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SAP S4HANA 4CORE 104 up to 108 privileges management
vuldb·2026-08-11·CVSS 4.3
CVE-2026-66764 [MEDIUM] SAP S4HANA 4CORE 104 up to 108 privileges management
A vulnerability was found in SAP S4HANA 4CORE 104 up to 108. It has been rated as problematic. Impacted is an unknown function. Performing a manipulation results in improper privilege management.
This vulnerability is known as CVE-2026-66764. Remote exploitation of the attack is possible. No exploit is available.
GHSA
Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in
ghsa_unreviewed·2026-08-11
CVE-2026-66764 [MEDIUM] CWE-639 Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in
Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-11
Published