---
id: "CVE-2026-89115"
page: "https://infrastack.ai/live/CVE-2026-89115"
kind: "vulnerability"
aliases: ["CVE-2026-89115"]
title: "SAP Start Service and Management Console keep credentials unprotected in memory"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["sap", "sap-management-console", "sap-start-service", "vendor"]
not_affected_if: ["no-local-high-privilege-access"]
published_at: "2026-11-10T01:17:21+00:00"
first_seen_at: "2026-11-10T01:26:43+00:00"
updated_at: "2026-11-10T01:28:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89115", "first_seen_at": "2026-11-10T01:26:43+00:00"}]
exploit_sources: []
---

# SAP Start Service and Management Console keep credentials unprotected in memory

Link for people: https://infrastack.ai/live/CVE-2026-89115 (this .md is for agents)

SAP Start Service and SAP Management Console store sensitive credential data in process memory without protection. An attacker with high privileges and local access can read that memory, recover the credentials, and reuse them to log in.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T01:26:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89115

## From the sources

SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_