Skip to main content
SAP Pentest Playbook
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  2. /
  3. Other SAP Solutions
  4. /
  5. SAP HANA DB
  6. /
  7. SAP HANA - Known CVEs
Edit page

SAP HANA - Known CVEs

Description

A version/revision fingerprint (SELECT VERSION FROM SYS.M_DATABASE; post-auth, or pre-auth banner grabs against 3<NN>13/3<NN>15/3<NN>07) matched against a small table of confirmed, SAP-Note-verified HANA CVEs. Unlike the ABAP kernel, HANA revision numbers are dense and rapidly superseded, so treat any version-range match as suspected pending confirmation of the exact patch level via SELECT * FROM M_SYSTEM_OVERVIEW WHERE SECTION = 'System'; or the SAP HANA cockpit’s version tile - do not report a finding from version string alone without this confirmation step.

Risk

  • CVE-2026-0492 - Privilege Escalation in SAP HANA database. CVSS 3.0 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-306. Confirmed via SAP Note 3691059 (13.01.2026): an attacker holding valid credentials for any user can switch to another user, potentially gaining administrative access. Affects HANA 2.00; SPS05/SPS06 explicitly not affected. Fixed at SPS07 revision 79.07 and SPS08 revision 88. No workaround. See Default Users, Credential Harvesting & Privilege Escalation for exploitation framing.
  • CVE-2026-34262 - Information Disclosure in SAP HANA Cockpit and HANA Database Explorer. CVSS 3.0 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N), CWE unspecified (private-key exposure). Confirmed via SAP Note 3730639 (14.04.2026): authenticated Cockpit/Database Explorer users can retrieve the server’s mTLS private key via the hrtt-service REST API in systems configured for mutual TLS to the HANA database. Affects SAP HANA Runtime Tools (HRTT) ≤ 2.16.254001 (HANA Cockpit < 2.18.2). SEC Consult independently disclosed this and notes the patch prevents further exposure but does not invalidate already-leaked keys - manual rotation is required regardless of what SAP’s note states. See Trace/Backup File & Credential Exposure.
  • CVE-2019-0261 - Missing authentication check in SAP HANA XS advanced. SAP-rated CVSS 3.0 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), CWE-306. Confirmed via SAP Note 2742027: XS advanced runtime 1.0.97–1.0.99 on HANA 1 or HANA 2 SPS0 fails authentication checks for XSA platform/business users. Fixed in XSA ≥1.0.100.
  • CVE-2016-6144 - Insufficient login-attempt limiting for SYSTEM. CVSS 3.0 8.1, CWE-284. Confirmed via SAP Note 2216869: SYSTEM excluded from lockout policy and verbose logon-failure messages enable enumeration, prior to HANA Revision 102. <!-- VERIFY: HANA 1.0-era; only relevant against legacy, long-unsupported revisions still present in a landscape. -->

Options

  • Fingerprint (post-auth):
    SELECT VERSION FROM SYS.M_DATABASE;
SELECT * FROM M_SYSTEM_OVERVIEW WHERE SECTION = 'System';
  • Fingerprint (pre-auth, network only): TLS/banner behavior on 3<NN>13 (SQL) and 3<NN>15 (HTTP/XSA controller) can suggest a major/SPS line but cannot reliably distinguish revision-level patches (e.g., SPS07 rev 78 vs. the fixed 79.07) - treat pre-auth version claims as suspected only, and always confirm post-auth or via the SAP HANA cockpit version tile before reporting.
  • Version-range match: HANA 2.00 SPS07 < rev 79.07, or SPS08 < rev 88 → suspected CVE-2026-0492. HRTT ≤ 2.16.254001 / Cockpit < 2.18.2 → suspected CVE-2026-34262. XS advanced 1.0.97–1.0.99 → suspected CVE-2019-0261.
  • An empty match must be read as “no rule matched,” never as “this version has no vulnerabilities” - this table is deliberately small and covers only what was independently verified via SAP Note + NVD this pass.

Mitigation

  • Patch to SPS07 rev ≥79.07 / SPS08 rev ≥88 (SAP Note 3691059).
  • Patch HANA Cockpit to ≥2.18.2 and manually rotate any mTLS private keys/certificates regardless of SAP’s stated guidance (SAP Note 3730639).
  • Patch XS advanced to ≥1.0.100 (SAP Note 2742027).
  • Subscribe to SAP Security Patch Day notes for component HAN-DB-SEC / HAN-CPT-* rather than relying solely on this static bucket, which lags new disclosures.

Detection and Monitoring

References