CVE-2026-89115
Received Received - Intake

Sensitive Credential Exposure in SAP Start Service and Management Console

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-89115
EUVD
EUVD-2026-120664

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sap start_service *
sap management_console *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-256 The product stores a password in plaintext within resources such as memory or files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication.

Detection Guidance

Detecting this vulnerability requires inspecting process memory for exposed credentials in SAP Start Service or SAP Management Console. Use system monitoring tools like 'strings' or 'gdb' to dump and analyze memory of SAP processes. Check for plaintext credentials in memory dumps of these services.

Impact Analysis

An attacker could gain unauthorized access to systems by recovering stored credentials from memory, potentially leading to data breaches or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA, potentially resulting in legal and regulatory penalties.

Mitigation Strategies

Apply SAP security notes and patches as recommended in SAP Note 3740168. Restrict local access to systems running SAP Start Service and SAP Management Console. Monitor process memory for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...