SAP Manufacturing Integration and Intelligence: Missing authorization check
Summary
SAP Manufacturing Integration and Intelligence (MII, also XMII) does not sufficiently enforce authorization boundaries in certain administrative functions. An attacker with MII administrator privileges can send a specially crafted request to create an account with elevated privileges on the underlying Java application server. Successful exploitation could give the attacker administrative control over that system, beyond the MII application itself.
Affected
- SAP MII (XMII) 15.4
- SAP MII (XMII) 15.5 (default configuration unaffected, according to the CNA record)
- Component: Configuration Service
Fixed in
- Apply the correction from SAP Note 3798788 (published on the October 13, 2026 Patch Day).
- Unverified third-party reports: XMII 15.4 SP001 Patch 059 and XMII 15.5 SP000 Patch 049. Confirm all fixed levels in SAP Note 3798788.
Workaround
- SAP reports no workaround for this note.
- Interim measure: limit the number of MII administrator accounts to the minimum until the patch is applied.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- No public proof of concept confirmed at the time of research.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Reported to SAP by Onapsis Research Labs.
Our recommendation
- Patch MII 15.4 and 15.5 promptly according to SAP Note 3798788.
- Reduce the number of MII administrators now and remove unneeded admin rights from integrators and service accounts.
- Review existing Java engine administrator accounts and check which MII users can create them.
- Check whether MII servers are reachable from outside the plant network and restrict access.
- Verify whether MII is installed at all; if not, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- SAP Note 3798788 me.sap.com
- SAP Security Patch Day url.sap
- SAP Security Notes October 2026 support.sap.com
- SecurityBridge: SAP Security Patch Day October 2026 securitybridge.com
- Onapsis: SAP Security Patch Day October 2026 onapsis.com
- Pathlock: SAP Patch Day October 2026 pathlock.com
- VulDB entry 417424 vuldb.com
- Strix: CVE-2026-89108 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:51.
Original description (NVD)
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.
NVD references (2)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.