CVE-2026-66764 Overview
CVE-2026-66764 is a missing authorization vulnerability in the Reprocess Bank Statement Items function of SAP S/4HANA. The application fails to validate whether an authenticated user is entitled to use reprocessing rules that were not shared with them. An attacker with low privileges on the network can invoke rules owned by other users, resulting in horizontal privilege escalation. The issue is tracked under CWE-639 (Authorization Bypass Through User-Controlled Key). Exploitation impacts confidentiality only, with no direct effect on integrity or availability.
Critical Impact
Authenticated users can apply bank statement reprocessing rules belonging to other users, exposing financial rule data and enabling unauthorized use of another user's configuration.
Affected Products
- SAP S/4HANA (Reprocess Bank Statement Items component)
- Refer to SAP Note #3669608 for the exact affected releases and support package levels
- Details are also aggregated in the SAP Security Patch Day Update
Discovery Timeline
- 2026-08-11 - CVE-2026-66764 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-66764
Vulnerability Analysis
The Reprocess Bank Statement Items feature in SAP S/4HANA allows users to apply reprocessing rules to unmatched bank statement entries. Rules are ordinarily bound to the user who created them and can be shared explicitly with other users or groups. The vulnerable code path accepts a rule identifier from the authenticated caller but omits the authorization check that verifies whether the rule has been shared with, or is owned by, that caller.
Because the server trusts a client-supplied key, a low-privileged authenticated user can enumerate or guess rule identifiers and invoke rules belonging to other users. The exposure is limited to confidentiality: the attacker learns rule contents and outcomes but cannot alter data outside the scope of the reprocessing action. Network reachability to the S/4HANA endpoint and valid credentials are the only preconditions.
Root Cause
The root cause is an Insecure Direct Object Reference pattern classified as [CWE-639]. The rule lookup uses the identifier passed by the caller without cross-checking the caller's identity against the rule's owner or shared-with list. The authorization decision is effectively delegated to the client, which the API does not enforce server-side.
Attack Vector
An attacker authenticates to SAP S/4HANA with any valid business user account. The attacker then issues a Reprocess Bank Statement Items request while supplying a rule identifier associated with a different user. The backend loads and executes the referenced rule without validating ownership or share status, returning the results to the attacker. No user interaction is required, and no elevated privileges are needed beyond a standard authenticated session.
No public proof-of-concept exploit is available for CVE-2026-66764 at the time of publication. See SAP Note #3669608 for vendor-specific technical details.
Detection Methods for CVE-2026-66764
Indicators of Compromise
- Bank statement reprocessing activity performed by a user account that is not the owner of the referenced rule and is not on the rule's sharing list.
- Repeated Reprocess Bank Statement Items calls from a single user referencing sequential or unrelated rule identifiers, consistent with enumeration.
- SAP application log entries showing rule execution outside the normal working scope of the invoking user.
Detection Strategies
- Correlate the executing user of each Reprocess Bank Statement Items call with the owner and share list of the referenced rule; alert on mismatches.
- Baseline per-user rule usage and flag deviations, such as a user suddenly invoking rules they have never used before.
- Ingest SAP security audit log (SM19/SM20) and application logs into a SIEM to enable cross-user correlation.
Monitoring Recommendations
- Enable and forward the SAP Security Audit Log with financial transaction events for Bank Statement processing.
- Monitor RFC and OData endpoints associated with Reprocess Bank Statement Items for unusual call volumes or rule-ID enumeration patterns.
- Review authorization traces (transaction ST01) periodically for failed and successful authority checks around bank statement objects.
How to Mitigate CVE-2026-66764
Immediate Actions Required
- Apply the SAP-provided fix documented in SAP Note #3669608 during the next available maintenance window.
- Review recent Reprocess Bank Statement Items activity to identify any cross-user rule invocations that occurred prior to patching.
- Restrict authorizations for bank statement reprocessing to users with a documented business need.
Patch Information
SAP released the fix as part of SAP Security Patch Day. The corrective code is delivered through SAP Note #3669608. Consult the SAP Security Patch Day Update for the full list of concurrent notes and prerequisites. Administrators should validate the note's applicability against their S/4HANA release and support package stack before implementation.
Workarounds
- If patching must be deferred, tighten role assignments so that only a minimal set of users can execute Reprocess Bank Statement Items.
- Audit and reduce the number of shared reprocessing rules to limit the value of any unauthorized access.
- Increase logging on the affected transactions and review activity daily until the patch is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
