CVE-2016-7402: SAP ASE 16.0 SP02 PL03 and prior versions allow attackers who own SourceDB and TargetDB databases to elevat...

Security readout for executives and security teams

This issue affects SAP ASE deployments at 16.0 SP02 PL03 and earlier. A database owner with control of both SourceDB and TargetDB could abuse a SQL injection flaw in dbcc import_sproc to become sa, the system administrator. That means the main risk is privilege escalation inside an already-accessed database environment. Likely exposure is limited to organizations running SAP ASE 16.0 SP02 PL03 or earlier, especially where untrusted or lower-privileged users can own databases. Confirm exposure from asset inventory, ASE version data, and database ownership records. Treat as a high-priority database hardening and patching issue where SAP ASE is still present. The business impact is serious because successful abuse grants system administrator control, but urgency depends on whether vulnerable ASE versions and risky database ownership exist. Mitigation focus: Identify SAP ASE instances and confirm exact service pack and patch level.; Prioritize upgrades for systems at 16.0 SP02 PL03 or earlier.; Check SAP or Trustwave guidance for the corrected build and supported remediation path..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.