CVE-2026-89115: Information Disclosure vulnerability in SAP Start Service and SAP Microsoft Management Console
Published Nov 10, 2026
·Updated
SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.
Affected Software
2 affected components
SAP SAP Start Service
SAP SAP Microsoft Management Console
Event History
Nov 10, 2026
CVE Published
via MITRE·12:19 AM
Data Sourced
via MITRE·12:19 AM
DescriptionSeverity
Data Sourced
via NVD·01:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs local access to the affected system and high privileges. The disclosed credentials could then be reused for authentication.
2
What is the expected impact of successful exploitation?
Successful exploitation allows recovery of sensitive credentials from process memory, creating a high confidentiality impact. The available information indicates no integrity or availability impact.