SAP Start Service Credential Exposure: CVE-2026-89115 · CVSS 3.0 4.4 · SAP Note 3740168
Note 3740168 fixes SAP Start Service (sapstartsrv) and the SAP Microsoft Management Console. Both kept passwords in process memory after use. Consequently, a local attacker with high privileges could dump the memory and reuse the credentials. SAP rates the SAP Start Service Credential Exposure at CVSS 4.4, Medium. In this post, we cover exposure, the fix and what to check.
SAP Start Service Credential Exposure: fixes by component
The fix spans several components. First, update kernel 7.22 to 9.20 via dw.sar or the SP Stack Kernel. Second, update standalone Web Dispatcher via SAPWEBDISP.SAR and SAP MMC via the SAP_MMC.MSI package. In addition, Content Server 7.53 and 7.54 and SAP HANA 2.0 need updates, with SPS08 rev. 089.04 or SPS07 rev. 079.11. FAQ: 3807355.
Context
The precondition is admin access on the host, so the score is low. Still, this issue matters for lateral movement. After all, credentials taken from one SAP host often work on others.
Why memory secrets matter
Attackers who gain admin rights usually dump process memory early, since it is a quick way to find passwords. Therefore, every secret that stays in memory longer than needed makes their job easier. Fixing the SAP Start Service Credential Exposure removes one easy source.
What to check
First, check which hosts still run SAP MMC, because it needs a separate update. Next, include the kernel and HANA fixes in your regular patch cycle. Finally, review whether SAP admin accounts share passwords across hosts, since that turns the SAP Start Service Credential Exposure into a landscape-wide risk.
SAP Start Service Credential Exposure: advisory details
Component: BC-CST-STS
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 7
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: SAP Security Note 3740168 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
