CVE-2026-0492
Published: 13 January 2026
Summary
CVE-2026-0492 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Sap Hana Database. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 20.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0492, published on 2026-01-13, is a privilege escalation vulnerability (CWE-306) in the SAP HANA database. It allows an attacker possessing valid credentials of any user to switch to another user context, potentially obtaining administrative access. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity and potential for total compromise of the system's confidentiality, integrity, and availability.
Exploitation requires network access and low-privilege user credentials, with low attack complexity and no user interaction needed. An attacker can leverage this to escalate privileges to administrative levels, achieving full control over the SAP HANA instance and enabling arbitrary actions such as data manipulation, deletion, or exfiltration.
SAP advisories provide mitigation through security patches. Details are available in SAP Note 3691059 at https://me.sap.com/notes/3691059 and the SAP Security Patch Day page at https://url.sap/sapsecuritypatchday.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2389
Vulnerability details
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and…
more
availability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation vulnerability allowing low-priv valid account to impersonate admin context via missing auth check (CWE-306).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely remediation of the privilege escalation flaw via SAP patches in Note 3691059 directly prevents exploitation of CVE-2026-0492.
Enforces approved authorizations to block unauthorized user context switching and privilege escalation in SAP HANA.
Principle of least privilege limits the impact of escalated administrative access by restricting unnecessary privileges.