High severity · published Jan 13, 2026
CVE-2026-0492
Privilege escalation vulnerability in SAP HANA database
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
SAP HANA database · SAP_SE
HDB 2.00 · source: vendor
HD
Hana Database · Sap
2.00 · source: NVD
