SAP S/4HANA CVE-2026-66764

Exploitation requires a valid authenticated SAP S/4HANA user account with at minimum the ability to access the Reprocess Bank Statement Items transaction (PR:L per CVSS vector). The attacker must supply the identifier of a rule that exists in the system but has not been shared with their account - requiring either enumeration of rule IDs or prior knowledge. No special system configuration beyond a standard SAP S/4HANA deployment with the Reprocess Bank Statement Items feature in use is needed. Exploitation is limited by: (1) the mandatory authenticated session - unauthenticated external attackers cannot exploit this; (2) the low confidentiality impact ceiling - only rule content is exposed, not credentials, full data extracts, or system-level access; (3) zero integrity and availability impact, ruling out data modification or disruption scenarios.

The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately characterizes this as a moderate, authenticated network-accessible vulnerability with limited confidentiality impact and no integrity or availability exposure. Real-world risk is further bounded by the requirement for a valid SAP user account (PR:L), meaning unauthenticated external attackers are excluded from the threat model. No EPSS data was provided in the source intelligence, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. The absence of a known public proof-of-concept further reduces urgency. That said, even a mid-sized municipal IT team in inowroclaw running SAP S/4HANA for treasury or financial operations should treat this as a timely patching item given that bank statement processing rules may contain sensitive business logic and configuration data that could aid further lateral movement within the ERP environment. The 'Privilege Escalation' and 'Authentication Bypass' tags applied by the reporter are somewhat overstated relative to the actual CVSS impact metrics: this is authorization bypass within an authenticated session, not full privilege escalation to administrative access.

An authenticated SAP S/4HANA user with a low-privilege account navigates to the Reprocess Bank Statement Items function and supplies the identifier of a processing rule that was created by another user or team and not shared with them. Because the server does not validate the sharing entitlement for the supplied rule ID, the request succeeds, and the attacker gains read access to the rule's logic and parameters - potentially exposing sensitive bank account mappings, posting rules, or financial processing configurations. No public proof-of-concept exploit code has been identified; exploitation requires knowledge of valid rule identifiers, obtainable through enumeration or insider knowledge.