Unauthenticated Information Disclosure Vulnerability in SAP HANA Database User Self-Service Tools
CVE-2026-44753

3.7LOW

Key Information:

Vendor

SAP
Status
SAP Hana Extended Application Services Classic Model (user Self Service)
Vendor
CVE Published:
14 July 2026

What is CVE-2026-44753?

The SAP HANA Database user self-service tools are susceptible to an information disclosure vulnerability that allows unauthenticated attackers to send specially crafted requests. This can lead to the enumeration of valid user accounts and email addresses, potentially compromising user privacy. While the confidentiality of the application is affected, the integrity and availability remain intact. It is crucial for organizations using SAP HANA Database to apply necessary patches and enhance their security measures to prevent exploitation.

Affected Version(s)

SAP HANA Extended Application Services classic model (User Self Service) HDB 2.00

References

https://me.sap.com/notes/3732522
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.