CVE-2026-44753

SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3732522
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) La Base de datos SAP HANA (herramientas de autoservicio de usuario) permite a un usuario no autenticado enviar solicitudes especialmente diseñadas que producen respuestas distinguibles, lo que permite la enumeración de cuentas de usuario válidas y direcciones de correo electrónico. Una explotación exitosa podría permitir al atacante enumerar cuentas de usuario válidas, lo que resulta en un bajo impacto en la confidencialidad, sin impacto en la integridad y disponibilidad de la aplicación.

Information

Published : 2026-07-14 01:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-44753

Mitre link : CVE-2026-44753

CVE.ORG link : CVE-2026-44753

JSON object : View

Products Affected

No product.

CWE

CWE-204

Observable Response Discrepancy

{"id": "CVE-2026-44753", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44753", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T12:38:19.965117Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP HANA Extended Application Services classic model (User Self Service)", "versions": [{"status": "affected", "version": "HDB 2.00"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T01:16:17.683", "references": [{"url": "https://me.sap.com/notes/3732522", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-204"}]}], "descriptions": [{"lang": "en", "value": "SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application."}, {"lang": "es", "value": "La Base de datos SAP HANA (herramientas de autoservicio de usuario) permite a un usuario no autenticado enviar solicitudes especialmente dise\u00f1adas que producen respuestas distinguibles, lo que permite la enumeraci\u00f3n de cuentas de usuario v\u00e1lidas y direcciones de correo electr\u00f3nico. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante enumerar cuentas de usuario v\u00e1lidas, lo que resulta en un bajo impacto en la confidencialidad, sin impacto en la integridad y disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2026-10-24T22:10:00.210", "sourceIdentifier": "cna@sap.com"}