CVE-2026-44753

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44753", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-05-07T18:31:04.066Z", "datePublished": "2026-07-14T00:19:58.321Z", "dateUpdated": "2026-07-14T12:38:29.089Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-07-14T00:19:58.321Z"}, "title": "Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-204", "description": "CWE-204: Observable Response Discrepancy", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP HANA Extended Application Services classic model (User Self Service)", "versions": [{"status": "affected", "version": "HDB 2.00"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3732522"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T12:38:19.965117Z", "id": "CVE-2026-44753", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:38:29.089Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44753", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T12:38:19.965117Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:38:25.561Z"}}], "cna": {"title": "Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP HANA Extended Application Services classic model (User Self Service)", "versions": [{"status": "affected", "version": "HDB 2.00"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3732522"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204: Observable Response Discrepancy"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-07-14T00:19:58.321Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44753", "state": "PUBLISHED", "dateUpdated": "2026-07-14T12:38:29.089Z", "dateReserved": "2026-05-07T18:31:04.066Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-07-14T00:19:58.321Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP HANA Extended Application Services classic model (User Self Service)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "HDB 2.00"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application."}, {"lang": "es", "value": "La Base de datos SAP HANA (herramientas de autoservicio de usuario) permite a un usuario no autenticado enviar solicitudes especialmente dise\u00f1adas que producen respuestas distinguibles, lo que permite la enumeraci\u00f3n de cuentas de usuario v\u00e1lidas y direcciones de correo electr\u00f3nico. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante enumerar cuentas de usuario v\u00e1lidas, lo que resulta en un bajo impacto en la confidencialidad, sin impacto en la integridad y disponibilidad de la aplicaci\u00f3n."}], "id": "CVE-2026-44753", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44753", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T12:38:19.965117Z", "version": "2.0.3"}}]}, "published": "2026-07-14T01:16:17.683", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3732522"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-204"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "HDB 2.00"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "SAP HANA Extended Application Services classic model (User Self Service)", "source": "cna", "vendor": "SAP_SE"}, "product": "sap_hana_extended_application_services_classic_model_(user_self_service)", "vendor": "sap_se"}], "created": "2026-07-14T13:00:04.570503+00:00", "updated": "2026-07-31T11:00:06.453344+00:00", "vendors": ["sap_se", "sap_se$PRODUCT$sap_hana_extended_application_services_classic_model_(user_self_service)"]}