CVE-2026-0492

High

Published: 13 January 2026

Published

13 January 2026

Modified

27 January 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0006 18.1th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0492 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Sap Hana Database. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Timely remediation of the privilege escalation flaw via SAP patches in Note 3691059 directly prevents exploitation of CVE-2026-0492.

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations to block unauthorized user context switching and privilege escalation in SAP HANA.

AC-6 Least Privilege partial match

prevent

Principle of least privilege limits the impact of escalated administrative access by restricting unnecessary privileges.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Direct privilege escalation vulnerability allowing low-priv valid account to impersonate admin context via missing auth check (CWE-306).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and…

availability.

Deeper analysisAI

CVE-2026-0492, published on 2026-01-13, is a privilege escalation vulnerability (CWE-306) in the SAP HANA database. It allows an attacker possessing valid credentials of any user to switch to another user context, potentially obtaining administrative access. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity and potential for total compromise of the system's confidentiality, integrity, and availability.

Exploitation requires network access and low-privilege user credentials, with low attack complexity and no user interaction needed. An attacker can leverage this to escalate privileges to administrative levels, achieving full control over the SAP HANA instance and enabling arbitrary actions such as data manipulation, deletion, or exfiltration.

SAP advisories provide mitigation through security patches. Details are available in SAP Note 3691059 at https://me.sap.com/notes/3691059 and the SAP Security Patch Day page at https://url.sap/sapsecuritypatchday.