Privilege Escalation Vulnerability in SAP Manufacturing Integration and Intelligence
CVE-2026-89108

9.1CRITICAL

Key Information:

Vendor

SAP
Status
SAP Manufacturing Integration And Intelligence (configuration Service)
Vendor
CVE Published:
13 October 2026

What is CVE-2026-89108?

The SAP Manufacturing Integration and Intelligence product has a vulnerability that fails to properly enforce authorization boundaries within certain administrative functions. An attacker holding MII administrator privileges can exploit this weakness by submitting a specially crafted request, which could result in the provisioning of an account with elevated privileges on the underlying Java application server. This exploitation can lead to unauthorized administrative control over the system, posing serious risks to confidentiality, integrity, and availability across the network.

Affected Version(s)

SAP Manufacturing Integration and Intelligence (Configuration Service) XMII 15.4

SAP Manufacturing Integration and Intelligence (Configuration Service) 15.5

References

https://me.sap.com/notes/3798788
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.