{"id":"CVE-2026-27689","aliases":["EUVD-2026-10464","GHSA-39w3-fg6q-3vw3"],"status":"published","title":"Denial of service (DOS) in SAP Supply Chain Management","description":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00427,"percentile":0.37294,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-606"],"published":"2026-03-10T00:19:05Z","modified":"2026-06-17T10:27:31Z","products":[{"vendor":"sap_se","product":"sap supply chain management"}],"references":[{"url":"https://me.sap.com/notes/3719502"},{"url":"https://url.sap/sapsecuritypatchday"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27689"},{"url":"https://github.com/advisories/GHSA-39w3-fg6q-3vw3"}],"sources":{"cve":[{"id":"CVE-2026-27689","title":"Denial of service (DOS) in SAP Supply Chain Management","description":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.","status":"published","published":"2026-03-10T00:19:05.551Z","modified":"2026-03-10T16:52:30.031Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-606"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-10464","description":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.","status":"published","published":"2026-03-10T00:19:05Z","modified":"2026-03-10T16:52:30Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:05.412027Z"}],"ghsa":[{"id":"GHSA-39w3-fg6q-3vw3","title":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated...","description":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.","status":"published","published":"2026-03-10T18:31:17Z","modified":"2026-03-10T18:31:24Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-606"],"updated_at":"2026-11-02T15:06:32.038351Z"}],"nvd":[{"id":"CVE-2026-27689","description":"Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.","status":"published","published":"2026-03-10T17:38:11.683Z","modified":"2026-06-17T10:27:31.407Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-606"],"updated_at":"2026-11-02T14:12:08.279852Z"}]}}