# CVE-2026-44753: SAP HANA Database user enumeration in User Self Service tools

Source: https://junglewise.ai/threats/cve-2026-44753-sap-hana-database-user-enumeration-in-user-self-service-tools  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-44753 · Severity: low · CVSS 3.7 · Published 2026-07-14

SAP HANA Database user self-service tools contain a flaw that allows unauthorized individuals to identify valid user accounts and email addresses. By sending specific requests and observing how the system responds, an attacker can map out existing users within the database. While this does not allow for direct data theft or system shutdown, it provides critical information that can be used to launch more targeted phishing or password-guessing attacks.

Vendors: [SAP SE](https://junglewise.ai/threats/vendors/sap-se).

## Quick answers

**Is CVE-2026-44753 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44753 being exploited in the wild.

**How severe is CVE-2026-44753?** Low severity, with a CVSS score of 3.7, published 14 July 2026.

**Which products and versions are affected?** SAP SE HANA Extended Application Services classic model HDB 2.00.

**Is there a fix for CVE-2026-44753?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44753 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44753?** Check whether you run SAP SE HANA Extended Application Services classic model at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An observable response discrepancy (CWE-204) exists in the SAP HANA Extended Application Services classic model (User Self Service). An unauthenticated remote attacker can send specially crafted requests to the self-service tools and distinguish between responses for valid and invalid users. This allows for the enumeration of valid user accounts and associated email addresses. The attack complexity is rated as high, likely due to the need for precise request crafting or timing analysis to differentiate responses. A fix is available via SAP Security Note 3732522.

## Affected products

- SAP SE HANA Extended Application Services classic model (User Self Service) HDB 2.00

## Timeline

- 2026-07-14: advisory: SAP Security Patch Day release
- 2026-07-14: disclosed: CVE published to NVD

## References

- [https://me.sap.com/notes/3732522](https://me.sap.com/notes/3732522)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)