{"api_version":"1","generated_at":"2026-11-10T10:44:01+00:00","cve":"CVE-2026-89115","urls":{"html":"https://cve.report/CVE-2026-89115","api":"https://cve.report/api/cve/CVE-2026-89115.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-89115","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-89115"},"summary":{"title":"Information Disclosure vulnerability in SAP Start Service and SAP Microsoft Management Console","description":"SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.","state":"PUBLISHED","assigner":"sap","published_at":"2026-11-10 01:17:21","updated_at":"2026-11-10 01:17:21"},"problem_types":["CWE-256","CWE-256 CWE-256: Plaintext Storage of a Password"],"metrics":[{"version":"3.1","source":"cna@sap.com","type":"Primary","score":"4.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.4","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://url.sap/sapsecuritypatchday","name":"https://url.sap/sapsecuritypatchday","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://me.sap.com/notes/3740168","name":"https://me.sap.com/notes/3740168","refsource":"cna@sap.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89115","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89115","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected HDB 2.00","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected KRNL64NUC 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected 7.22EXT","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected KRNL64UC 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected 7.53","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected CONTSERV 7.53","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected 7.54","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected KERNEL 7.22","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected 7.77","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected 7.93","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected 9.16","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected 9.18","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected 9.19","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected 9.20","platforms":[]},{"source":"CNA","vendor":"SAP_SE","product":"SAP Start Service and SAP Microsoft Management Console","version":"affected MMC 7.93","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"SAP Start Service and SAP Microsoft Management Console","vendor":"SAP_SE","versions":[{"status":"affected","version":"HDB 2.00"},{"status":"affected","version":"KRNL64NUC 7.22"},{"status":"affected","version":"7.22EXT"},{"status":"affected","version":"KRNL64UC 7.22"},{"status":"affected","version":"7.53"},{"status":"affected","version":"CONTSERV 7.53"},{"status":"affected","version":"7.54"},{"status":"affected","version":"KERNEL 7.22"},{"status":"affected","version":"7.77"},{"status":"affected","version":"7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"9.18"},{"status":"affected","version":"9.19"},{"status":"affected","version":"9.20"},{"status":"affected","version":"MMC 7.93"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.</p>"}],"value":"SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-256","description":"CWE-256: Plaintext Storage of a Password","lang":"eng","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T00:43:38.826Z","orgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","shortName":"sap"},"references":[{"url":"https://me.sap.com/notes/3740168"},{"url":"https://url.sap/sapsecuritypatchday"}],"source":{"discovery":"UNKNOWN"},"title":"Information Disclosure vulnerability in SAP Start Service and SAP Microsoft Management Console","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"e4686d1a-f260-4930-ac4c-2f5c992778dd","assignerShortName":"sap","cveId":"CVE-2026-89115","datePublished":"2026-11-10T00:19:19.363Z","dateReserved":"2026-09-10T22:25:18.638Z","dateUpdated":"2026-11-10T00:43:38.826Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 01:17:21","lastModifiedDate":"2026-11-10 01:17:21","problem_types":["CWE-256","CWE-256 CWE-256: Plaintext Storage of a Password"],"metrics":{"cvssMetricV31":[{"source":"cna@sap.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"89115","Ordinal":"1","Title":"Information Disclosure vulnerability in SAP Start Service and SA","CVE":"CVE-2026-89115","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"89115","Ordinal":"1","NoteData":"SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.","Type":"Description","Title":"Information Disclosure vulnerability in SAP Start Service and SA"}]}}}