Key points
- CVE-2026-89108 carries a CVSS score of 9.1, rated critical by the NVD.
- The flaw affects SAP Manufacturing Integration and Intelligence versions 15.4 and 15.5.
- Attackers with existing admin rights can gain full control of the host system.
SAP Manufacturing Integration and Intelligence contains a critical security flaw that allows attackers to escalate privileges on the underlying Java application server. The National Vulnerability Database assigned CVE-2026-89108 to this issue, rating it with a CVSS score of 9.1.
The vulnerability stems from insufficient enforcement of authorization boundaries within specific administrative functions. According to the NVD record, an attacker who already holds MII administrator privileges can submit a specially crafted request. This action provisions an account with elevated privileges on the Java server.
Scope of the breach
Successful exploitation extends the impact beyond the vulnerable application itself. The attacker gains administrative control over the underlying system, which results in high impact on confidentiality, integrity and availability. The weakness is classified under CWE-862, indicating improper privilege management.
Who is affected
The flaw specifically impacts SAP Manufacturing Integration and Intelligence (Configuration Service) XMII versions 15.4 and 15.5. Organisations running these versions of the Configuration Service are exposed to this risk. No other versions are listed in the current advisory.
What happens next
Security teams should verify if their environments run the affected versions. Monitoring for vendor updates is essential. Immediate mitigation may involve restricting administrative access to the Configuration Service.
What to do and how to stay safe: SAP
- Audit user accounts with MII administrator privileges to limit exposure.
- Monitor logs for unusual provisioning requests or privilege changes.
- Isolate affected systems from sensitive networks until a fix is available.
- Review firewall rules to restrict access to administrative interfaces.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-89108?
The NVD rates the vulnerability as critical with a CVSS score of 9.1.
Which SAP MII versions are vulnerable?
Versions 15.4 and 15.5 of SAP Manufacturing Integration and Intelligence are affected.
Can an external attacker exploit this flaw?
An attacker must first have MII administrator privileges to exploit this vulnerability.
