medium · CVSS v3 4.4

CVE-2026-89115

SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection…

Description

SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.

Scores

Severity
medium
CVSS v2
4.3
CVSS v3
4.4
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-109796

SAP NetWeaver Application Server ABAP and ABAP Platform does not properly initialize memory in certain internal components. Under certain condition, an attacker with low privileges could disclose uninitialized memory contents under specific conditions. This results in a low impact on confidentiality. There is no impact on integrity and availability.

View analysis

medium

CVE-2026-109801

SAP NetWeaver Application Server Java (NWDI Cockpit) has an authorization bypass that allows low‑privilege users to retrieve sensitive data from other users. This flaw can expose confidential information without affecting integrity or availability. Defenders should ensure the latest patch is applied and review access controls.

View analysis

medium

CVE-2026-109802

SAP NetWeaver Application Server for ABAP contains an input validation flaw that allows authenticated users to send crafted requests, triggering internal errors that crash work processes and cause a denial of service. The flaw does not affect confidentiality or integrity, but it can render the system unavailable. It is a medium‑severity vulnerability with a CVSS score of 6.5.

View analysis

medium

CVE-2026-109805

Due to a weak HMAC cryptography calculation when receiving an RFC callback in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker with high privileges and access to a network segment between application servers on an SAP system could intercept network communication between application servers and change the identity of the caller, enabling the execution of unauthorized function calls on the target server with escalated privileges leading to High impact on Confidentiality, Integrity, and Availability of the application.

View analysis