Description
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability.
Published: 2026-01-13
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation through user account switching
Action: Patch
AI Analysis

Impact

A flaw in the SAP HANA database allows an authenticated user to switch to the session of another user, which can result in administrative access. The effect is a full compromise of confidentiality, integrity, and availability. The root weakness is an authorization flaw (CWE‑306).

Affected Systems

SAP SE’s SAP HANA database is affected. No specific release or version information is provided in the CNA data.

Risk and Exploitability

The CVSS score is 8.8, indicating high severity, but the EPSS score is under 1 %, showing a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is authenticated application‑level access, requiring a valid user credential to trigger the privilege escalation.

Generated by OpenCVE AI on April 18, 2026 at 06:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest SAP HANA security patch that removes unauthorized user switching functionality
  • Configure the database to enforce strict role‑based access control and verify that users do not have broader privileges than necessary
  • Monitor and log any account switching events and set alerts for anomalous use of administrative accounts

Generated by OpenCVE AI on April 18, 2026 at 06:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Jan 2026 20:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:sap:hana_database:2.00:*:*:*:*:*:*:*

Tue, 13 Jan 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Jan 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Sap
Sap hana
Sap hana Database
Vendors & Products Sap
Sap hana
Sap hana Database

Tue, 13 Jan 2026 01:45:00 +0000

Type Values Removed Values Added
Description SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability.
Title Privilege escalation vulnerability in SAP HANA database
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Sap Hana Hana Database
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-02-26T15:04:49.557Z

Reserved: 2025-12-09T22:06:35.056Z

Link: CVE-2026-0492

cve-icon Vulnrichment

Updated: 2026-01-13T16:20:34.548Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-13T02:15:51.243

Modified: 2026-01-27T20:18:16.730

Link: CVE-2026-0492

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T07:00:11Z

Weaknesses