CVE-2026-0492
HighSummary
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This could result in a total compromise of the system's confidentiality, integrity, and availability.
Risk Assessment
An attacker can gain full control over the database, leading to compromise of all security aspects of the system.
Recommendation
It is recommended to immediately apply SAP patches and monitor user activity for unusual privilege changes.
Other vulnerabilities in SAP HANA
See all- CVE-2016-6144High
The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as 'False'. This makes it easier for remote attackers to bypass authentication via a brute force attack.
- CVE-2015-7986High
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request.
- CVE-2015-1311High
The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors.
- CVE-2014-8588High
SQL injection vulnerability in metadata.xsjs in SAP HANA 1.00.60.379371 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2016-6150Critical
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, allowing remote attackers to bypass intended access restrictions.
- CVE-2016-1929Critical
The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files, potentially leading to denial of service (disk consumption and process crash) via a crafted HTTP request.
Original NVD description (English source)
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability.