Vulnerability threat dossier

CVE-2026-66773

Vendor unknownProduct mapping pending

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability.

VTP deterministic threat2.0of 100 · CVSS excluded

VTP analyst assessment

No AI candidate assessment for this subject

AI-assisted analytical recommendationDoes not set factual exploitation state

AI classificationNO ALERT

AI priorityNONE

AI confidenceUnknown

Public exploitation · VTP factUNKNOWN

Assessment

The latest persisted AI review did not propose this CVE for analyst escalation. Deterministic monitoring remains authoritative for the factual states below.

Why it matters

Unknown from persisted AI analysis.

Evidence

No AI candidate evidence set is persisted for this CVE.

Uncertainties

No first-party sensor telemetry is configured. Local exploitation observation is unknown.

Next watchpoint · deterministic

Independent primary confirmation of active exploitation would materially change this assessment.

AI analysis history (0)

Technical severityMEDIUMCVSS 5.9 · technical context

Public exploitationUNKNOWNGlobal public evidence

Exploit maturityNONE KNOWNReliability not implied

EPSS0.009th percentile · prediction

Evidence confidence0%Strongest independent active claim

VelocitySTABLEMaterial events only

First-party telemetryNo first-party sensor telemetry configured.

Availability: NO_SENSOR_CONFIGURED · Evidence: UNKNOWN

VTP deterministic assessment

Why this matters

01
EPSS is 0.00; this is predictive context, not exploitation evidence.
02
No first-party sensor telemetry is configured; first-party observation is unknown.

Material change ledger

What changed

02:00CERT ADVISORYNew CERT advisory

Claim provenance

Evidence and source independence

1publications detected

1underlying evidence chains

1 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Event history

Threat timeline

00:0011 Aug
CERT ADVISORY
New CERT advisory
CERT-FR published evidence linked to CVE-2026-66773.

Original publications

Source record

11 Aug, 00:00

CERT-FRCERTINDEPENDENT

Multiples vulnérabilités dans les produits SAP (11 août 2026)

De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

CVE-2025-42947CVE-2025-58057CVE-2026-33871CVE-2026-34265CVE-2026-34480CVE-2026-40130CVE-2026-42945CVE-2026-44758CVE-2026-44762CVE-2026-44763CVE-2026-44764CVE-2026-44765CVE-2026-44772CVE-2026-5598CVE-2026-58230CVE-2026-58231CVE-2026-58233CVE-2026-58235CVE-2026-58236CVE-2026-58237CVE-2026-58238CVE-2026-58239CVE-2026-58241CVE-2026-58243CVE-2026-58244CVE-2026-58245CVE-2026-58247CVE-2026-58248CVE-2026-66760CVE-2026-66761CVE-2026-66763CVE-2026-66764CVE-2026-66770CVE-2026-66771CVE-2026-66772CVE-2026-66773CVE-2026-66774CVE-2026-66775CVE-2026-66776CVE-2026-66777CVE-2026-66778CVE-2026-66779

Separate evidence group

Original

Technical vulnerability data

Context, not threat proof

VTP threat score2.0vtp-threat-v1-public

Public exploitation0 / 30

EPSS prediction0.04 / 20

Exploit availability0 / 15

Source independence0 / 15

Intelligence recency0 / 10

Threat acceleration2 / 10

CVSS technical severityExcluded

CVSS: 5.9 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
CWE: CWE-601
CPE records: 0
Deterministic history records: 3

Primary technical reference

Raw observations

First-party sensor records

No first-party sensor telemetry configured.