SAP Social Intelligence CVE-2026-66770

Requires a valid authenticated user account in SAP Social Intelligence with at minimum low-privilege access (CVSS PR:L confirmed). Network access to the SAP Social Intelligence application is required (AV:N). No user interaction from a higher-privileged user is needed (UI:N), and no special non-default configuration is indicated - the vulnerability appears present in standard deployments of the affected versions. Exploitation is limited by the credential requirement: unauthenticated external attackers cannot exploit this flaw without first obtaining application credentials via phishing, credential stuffing, or insider access. Affected releases are specifically enumerated as versions 102-109 (including S4FND 102); deployments on unaffected or patched versions are not at risk.

The CVSS 6.3 Medium rating reflects a network-accessible (AV:N), low-complexity (AC:L), low-privilege-required (PR:L) attack with no user interaction and unscoped, uniformly Low impact across all three CIA dimensions. The combination of AV:N and AC:L means exploitation is technically straightforward for any authenticated account holder, requiring no special configuration or timing. However, the PR:L constraint is a meaningful gate: an attacker must possess a valid application credential. The DDL injection capability is more dangerous than the Low impact scores imply - DDL can structurally destroy tables or alter schema, which may cause outages or corrupt downstream integrations in ways that a Low availability rating understates. No EPSS data was provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public exploit code have been identified, which together reduce urgency compared to similarly scored, actively exploited vulnerabilities. SSVC signals: exploitation status is 'none' per available data; the attack is not automatable at scale due to the credential prerequisite; technical impact is partial. The net assessment is a genuine Medium-priority patch - not emergency response, but not deferrable indefinitely given that any compromised or malicious low-privilege account could cause irreversible database structural damage.

An attacker with a valid low-privilege SAP Social Intelligence user account submits a crafted request containing SQL DDL payload through an insufficiently sanitized application input field - such as a search or filter parameter. The application passes the unsanitized input to the database, where the DDL statement executes with the application service account's privileges. The attacker can issue commands such as DROP TABLE or ALTER TABLE, corrupting schema objects and causing data loss or application failure.