Hana Database CVE-2026-0492
HIGH
Missing Authentication for Critical Function (CWE-306)
2026-01-13
cna@sap.com
8.8
CVSS 3.1
Share
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Lifecycle Timeline
3
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
Patch released
Jan 27, 2026 - 20:18 nvd
Patch available
CVE Published
Jan 13, 2026 - 02:15 nvd
HIGH 8.8
DescriptionNVD
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability.
AnalysisAI
Hana Database versions up to 2.00 is affected by missing authentication for critical function (CVSS 8.8).
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 7 days: Identify all affected systems and apply vendor patches promptly. Audit authentication configurations and rotate any potentially compromised credentials.
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).