CVE-2026-44753
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability in SAP HANA Database (user self service tools) allows an unauthenticated attacker to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could lead to account enumeration, resulting in low impact on confidentiality, with no impact on integrity and availability.
Risk Assessment
The risk involves potential disclosure of valid user accounts and email addresses, which could be leveraged for further attacks such as phishing or brute-force, expanding the organization's attack surface.
Recommendation
It is recommended to immediately apply patches provided by SAP for SAP HANA Database and restrict access to user self service tools to trusted networks only.
Original NVD description (English source)
SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.