CVE-2026-44753: SAP HANA Database Info Disclosure Flaw

CVE-2026-44753 Overview

CVE-2026-44753 affects the SAP HANA Database user self service tools. An unauthenticated attacker can send specially crafted requests that produce distinguishable responses. These response differences allow enumeration of valid user accounts and email addresses in the target system.

The issue is classified as [CWE-204: Observable Response Discrepancy]. Exploitation requires network access but no privileges or user interaction. Successful attacks yield low confidentiality impact, with no effect on integrity or availability.

Critical Impact
Unauthenticated attackers can enumerate valid SAP HANA user accounts and email addresses, enabling targeted follow-on attacks such as credential stuffing, password spraying, and spear-phishing campaigns.

Affected Products

SAP HANA Database
SAP HANA user self service tools component
Refer to SAP Note 3732522 for the affected version list

Discovery Timeline

2026-07-14 - CVE-2026-44753 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-44753

Vulnerability Analysis

The vulnerability resides in the SAP HANA Database user self service tools. These tools expose functionality such as password reset and account lookup to unauthenticated users. The server returns responses that differ based on whether the submitted identifier corresponds to a real user account.

By comparing response bodies, HTTP status codes, headers, or timing, an attacker distinguishes existing accounts from non-existent ones. The same behavior leaks whether an email address is associated with a registered user. High attack complexity applies because reliable enumeration requires observation of subtle response variance rather than a direct oracle.

The EPSS probability is 0.22%, reflecting low expected exploitation activity, but user enumeration remains a common precursor to authentication attacks. No public exploit or proof of concept is currently listed.

Root Cause

The root cause is an observable response discrepancy [CWE-204]. Self service endpoints do not normalize responses between valid and invalid identifiers. Instead of returning a uniform generic message for every submission, the application produces distinguishable output that reveals account existence.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker iterates candidate usernames or email addresses against the vulnerable self service endpoint. Response comparison yields a list of valid accounts, which attackers can then use for credential stuffing, password spraying, or targeted phishing against SAP HANA identities.

No verified exploit code is available. Refer to SAP Note 3732522 for vendor technical details.

Detection Methods for CVE-2026-44753

Indicators of Compromise

High volumes of requests to SAP HANA user self service endpoints originating from a single source IP or narrow IP range
Sequential or dictionary-style submissions of usernames or email addresses within short time windows
Requests that yield alternating response sizes or status codes consistent with valid versus invalid account probing

Detection Strategies

Deploy web application firewall rules that rate-limit and alert on repeated self service tool requests from the same client
Correlate access logs to identify enumeration patterns such as monotonic username iteration or repeated password reset requests without follow-up authentication
Baseline normal self service traffic volumes and alert on statistical anomalies

Monitoring Recommendations

Forward SAP HANA HTTP access logs to a centralized SIEM for pattern analysis and long-term retention
Monitor authentication logs for password spraying that follows enumeration attempts on the same accounts
Track failed login clusters against the enumerated account set to identify progression from reconnaissance to active attack

How to Mitigate CVE-2026-44753

Immediate Actions Required

Apply the patch referenced in SAP Note 3732522 as published on SAP Security Patch Day
Restrict network access to the SAP HANA user self service tools to trusted internal networks or VPN clients
Enforce rate limiting and CAPTCHA on public-facing self service endpoints

Patch Information

SAP has released a fix through the standard SAP Security Patch Day process. Administrators should review SAP Note 3732522 for the affected component versions, patch levels, and installation instructions. Additional advisories are available on the SAP Security Patch Day portal.

Workarounds

Place the self service tools behind an authenticated reverse proxy or identity-aware access gateway
Configure the web tier to return uniform, generic responses for all identifier submissions until the patch is applied
Disable the user self service tools if they are not required for operational workflows

bash

# Example: restrict access to SAP HANA self service endpoints at the reverse proxy
# nginx configuration snippet
location /sap/hana/xs/selfService/ {
    allow 10.0.0.0/8;      # internal network only
    deny  all;
    limit_req zone=selfservice burst=5 nodelay;
    proxy_pass https://hana-backend;
}