VulnerabilityAnalyzed
CVE-2026-0492
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access.
HIGH 8.8EPSS 0.33%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.33% probability · 25th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- sap/hana database
- Source
- cna@sap.com
References
- https://me.sap.com/notes/3691059Permissions Required
- https://url.sap/sapsecuritypatchdayPatch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.