by Kastro
Paper/Archive/CVE-2026-89108

CVE-2026-89108

SAP_SE SAP Manufacturing Integration and Intelligence (Configuration Service) — Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 32.6.326 × 206.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.

Affected

ProductAffectedFixed inSource
SAP Manufacturing Integration and Intelligence (Configuration Service)XMII 15.4–CNA
SAP Manufacturing Integration and Intelligence (Configuration Service)15.5–CNA

Scores by source

sap (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3798788refurl.sap/sapsecuritypatchday