CVE-2026-0492CWE-306

Privilege escalation vulnerability in SAP HANA database

High · published January 13, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
25.3
In the wild
Unconfirmed
What it is

🚨 An attacker with valid credentials can escalate their privileges like a sneaky chameleon changing colors! ⚡ Think of a theme park where someone with a regular entry ticket manages to sneak into the VIP area, enjoying all the perks without the rightful access. That's how this vulnerability works—one user can impersonate another and gain administrative privileges. If exploited, this vulnerability could lead to a complete compromise of your SAP HANA database, allowing an attacker to not only view sensitive data but also alter or delete it, wreaking havoc on your organization's integrity and availability. Imagine an intruder dismantling the entire security of your theme park, leaving everything exposed and vulnerable!

Put simply

Think of a theme park where someone with a regular entry ticket manages to sneak into the VIP area, enjoying all the perks without the rightful access. That's how this vulnerability works—one user can impersonate another and gain administrative privileges. This privilege escalation flaw allows an authenticated user to switch identities with another user, potentially granting them administrative rights without proper authorization checks in place.

What to do

If exploited, this vulnerability could lead to a complete compromise of your SAP HANA database, allowing an attacker to not only view sensitive data but also alter or delete it, wreaking havoc on your organization's integrity and availability. Imagine an intruder dismantling the entire security of your theme park, leaving everything exposed and vulnerable! Immediate action is essential! Ensure you review user access controls, apply any available patches, and monitor user activity for unusual behavior. It's critical to limit the number of users with high-level access as a precautionary measure. You've got this! Follow these steps and you’ll fortify your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00333 · 25.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-01-13T01:13Z
EPSS history
Timeline
  • 13 JAN 01:13Z
    Privilege escalation vulnerability in SAP HANA database
    cvelistv5