CVE-2026-89108 is a critical missing-authorization flaw (CVSS 9.1) in SAP Manufacturing Integration and Intelligence. An attacker with MII administrator privileges could use it to create an elevated account on the underlying Java application server and take administrative control of the host system.
What Is It
SAP Manufacturing Integration and Intelligence (MII) does not properly enforce authorization boundaries in some of its administrative functions. An attacker who already holds MII administrator privileges could send a specially crafted request that creates an account with elevated privileges on the underlying Java application server.
The weakness is classified as CWE-862 (Missing Authorization). SAP, acting as the CNA, scored it CVSS 3.1 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Why It Matters
The main concern is privilege escalation across a security boundary. An attacker who starts as an MII application administrator could end up controlling the underlying system, so the damage can extend beyond the vulnerable application. That is why the CVSS score uses a Changed scope. The impact on confidentiality, integrity and availability is rated High.
Several factors limit and shape the risk:
- Access needed: the attack works over the network but requires high privileges (PR:H). It does not need user interaction, and attack complexity is Low.
- Where it matters most: compromised or malicious MII administrator accounts, and environments where MII admin rights are given out more widely than admin rights on the underlying application server.
- Exploitation status: as of this brief, CVE-2026-89108 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog. There is currently no KEV confirmation that it is being actively exploited.
What's Vulnerable
SAP reports the following product and versions as affected:
- Product: SAP Manufacturing Integration and Intelligence (Configuration Service)
- Vendor: SAP SE
- Affected versions:
- XMII 15.4
- 15.5
SAP lists all other versions as unaffected by default. NVD has not yet published CPE mappings for this record.
Patch Status
NVD has published this CVE, and its analysis status is "Received," meaning NVD has not yet enriched the record. SAP's references point to SAP Security Note 3798788 and the SAP Security Patch Day page. Organizations running affected MII versions should review that note for SAP's remediation guidance and apply the fix it describes.
Since there is no KEV entry, no CISA-mandated required action or due date applies.
In the meantime, defenders can limit exposure by reviewing who holds MII administrator privileges. They should also audit the underlying Java application server for accounts that were created unexpectedly or that have elevated privileges.