CVE-2026-89108
published 2026-10-13CVE-2026-89108: SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker…
PriorityP358critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
0.30%
21.6th percentile
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap_se | sap_manufacturing_integration_and_intelligence | — | — |
| sap_se | sap_manufacturing_integration_and_intelligence | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SAP Manufacturing Integration and Intelligence 15.5/XMII 15.4 improper authorization
vuldb·2026-10-13·CVSS 9.1
CVE-2026-89108 [CRITICAL] SAP Manufacturing Integration and Intelligence 15.5/XMII 15.4 improper authorization
A vulnerability classified as problematic has been found in SAP Manufacturing Integration and Intelligence 15.5/XMII 15.4. The affected element is an unknown function. Performing a manipulation results in improper authorization.
This vulnerability was named CVE-2026-89108. The attack may be initiated remotely. There is no available exploit.
GHSA
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality.
ghsa_unreviewed·2026-10-13
CVE-2026-89108 [CRITICAL] CWE-862 SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality.
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.
No detection rules found.
No public exploits indexed.
2026-10-13
Published