SAP HANA XSC CVE-2026-44753

Exploitation requires that the SAP HANA Extended Application Services Classic Model (XSC) user self-service feature is deployed and network-accessible to the attacker - this is a component-level deployment condition, not just a configuration flag, meaning organisations that have never deployed XSC or have decommissioned it are not affected. No authentication is required (PR:N confirmed by CVSS vector). High attack complexity (AC:H) limits exploitation: the attacker must reliably measure or detect response discrepancies, which may require multiple requests, statistical analysis, or control over network conditions to suppress noise. Access from external untrusted networks is possible if the self-service portal is internet-facing. Exploitation is limited entirely to account and email address enumeration; no code execution, data modification, or denial-of-service is achievable through this vulnerability alone.

The CVSS 3.1 base score of 3.7 accurately reflects the limited real-world risk: the vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N indicates that while the endpoint is network-reachable without authentication, the high attack complexity (AC:H) suggests the distinguishable responses require non-trivial effort to detect reliably - such as precise timing measurement or differential analysis under variable network conditions. The confidentiality impact is bounded to account/email existence disclosure only; there is no integrity or availability impact. No EPSS score was provided in source data, but the low CVSS and absence of KEV listing or POC code suggest minimal exploitation pressure at this time. The primary real-world concern is use of enumerated accounts as a reconnaissance input to downstream credential-stuffing or spear-phishing campaigns, which elevates indirect risk beyond what the base score alone implies for organizations with exposed self-service portals.

An unauthenticated attacker with network access to the SAP HANA XSC user self-service portal submits a series of crafted account-lookup or password-reset requests cycling through candidate usernames or email addresses. By measuring and comparing response characteristics - such as timing differences, HTTP response codes, or subtle body content variations - the attacker distinguishes valid accounts from invalid ones. The resulting account list is then used as seed data for targeted phishing campaigns or credential-stuffing attacks against SAP or related enterprise systems. No public proof-of-concept code has been identified at time of analysis.