What’s Vulnerable › Vulnerabilities

CVE-2026-44753: Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-204

Description

SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.

Affected products

• SAP_SE SAP HANA Extended Application Services classic model (User Self Service): HDB 2.00

References

• https://me.sap.com/notes/3732522
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-44753 or the next vulnerability affects your stack