SAP MII Flaw Allows Admins to Escalate Privileges on Java Server
A critical vulnerability in SAP Manufacturing Integration and Intelligence lets administrators gain full control of the underlying Java application server.
Key points
- CVE-2026-89108 is rated Critical with a CVSS score of 9.1 by the National Vulnerability Database.
- The flaw affects SAP Manufacturing Integration and Intelligence versions 15.4 and 15.5.
- Attackers with existing MII admin rights can provision accounts with elevated privileges on the Java server.
The National Vulnerability Database has published details for CVE-2026-89108, a critical vulnerability in SAP Manufacturing Integration and Intelligence. This flaw allows attackers with administrative privileges within the application to escalate their access to the underlying Java application server.
At a glance
- CVE
- CVE-2026-89108
- Product
- SAP_SE SAP Manufacturing Integration and Intelligence (Confi
- CVSS
- 9.1 Critical
- Weakness
- missing authorization
- Exploited
- No known exploitation
The vulnerability stems from insufficient authorization boundary enforcement within certain administrative features. According to the NVD record, an attacker can submit a specially crafted request to provision an account with higher privileges on the Java server. This action extends the impact beyond the vulnerable application itself.
Escalation Beyond Application Boundaries
Successful exploitation grants the attacker administrative control over the underlying system. The NVD describes this as a high impact on confidentiality, integrity, and availability. The weakness is classified under CWE-862, which relates to incorrect permission assignment for sensitive resources.
That suggests the primary risk is not initial unauthorized access, but rather the lateral movement from application-level admin rights to system-level control. The attacker must already possess MII administrator privileges to trigger the vulnerability.
Affected Versions and Scope
The flaw specifically impacts SAP Manufacturing Integration and Intelligence (Configuration Service) XMII versions 15.4 and 15.5. Organizations running these specific versions of the Configuration Service are exposed to this privilege escalation path. No other versions were listed in the NVD record as affected.
The vendor, SAP SE, is the maker of the affected software. The NVD record does not mention any other products or versions being impacted by this specific authorization bypass. Security teams should verify their installed versions against this list.
What should you do?
No patch or fix has been confirmed yet in the source material. Security professionals should monitor vendor channels for updates. Until a fix is available, organizations should limit the number of users with MII administrator privileges to reduce the attack surface.
What to do and how to stay safe: SAP
- Audit current users with MII administrator privileges to ensure only essential personnel retain these accounts.
- Monitor Java application server logs for unexpected account provisioning or privilege escalation attempts.
- Verify installed versions of SAP Manufacturing Integration and Intelligence against the affected list (15.4, 15.5).
- Wait for the vendor to release an official update before applying any unverified workarounds.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-89108?
The National Vulnerability Database rates CVE-2026-89108 as Critical with a CVSS score of 9.1.
Which versions of SAP MII are affected by this vulnerability?
SAP Manufacturing Integration and Intelligence (Configuration Service) XMII versions 15.4 and 15.5 are affected.
Does this vulnerability allow remote code execution?
The source material states it allows an attacker to gain administrative control over the underlying system, but does not explicitly mention remote code execution.
