CVE-2026-0492 Privilege escalation vulnerability in SAP HANA database

What is CVE-2026-0492?

CVE-2026-0492 is a high-severity vulnerability in SAP_SE SAP HANA database, published on 13 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability.

Weakness: CWE-306

Which versions are affected by CVE-2026-0492?

It affects 1 product.

Products include Sap Hana Database.

How do I fix CVE-2026-0492?

No fix has been published for CVE-2026-0492 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-0492 being exploited?

There is no known exploitation of CVE-2026-0492 in the wild and no public exploit code.

Other vulnerabilities in SAP_SE SAP HANA database

• CVE-2018-2424 Cross-site scripting in SAP HANA Database Critical 9.8
• CVE-2019-0350 Denial of service in SAP HANA Database High 7.5
• CVE-2021-21474 Weak cryptography in SAP HANA Database Medium 6.5
• CVE-2017-16687 Information disclosure in SAP HANA extended application services Medium 5.3
• CVE-2020-26834 Auth bypass in SAP HANA Database Medium 4.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-67mq-54j2-cv5m.