CVE-2026-66764
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.
Risk Assessment
The vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application. It could lead to unauthorized access to processing rules.
Recommendation
Update SAP S/4HANA and review and strengthen access controls for the Reprocess Bank Statement Items function.
Original NVD description (English source)
Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with them, resulting in privilege escalation.This vulnerability has a low impact on confidentiality, with no impact on integrity and availability of the application