CVE-2026-44758

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability of the application.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3758900
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP Manufacturing Integration y Intelligence (MII) permite a un atacante con privilegios elevados enviar una entrada especialmente diseñada a cierta funcionalidad afectada, la cual se procesa sin validación suficiente. La explotación exitosa podría permitir al atacante ejecutar comandos arbitrarios en el sistema operativo subyacente, lo que resulta en un alto impacto en la confidencialidad, integridad y disponibilidad de la aplicación.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-44758

Mitre link : CVE-2026-44758

CVE.ORG link : CVE-2026-44758

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-44758", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44758", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T13:25:40.358481Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Manufacturing Integration and Intelligence", "versions": [{"status": "affected", "version": "XMII 15.4"}, {"status": "affected", "version": "15.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:20.670", "references": [{"url": "https://me.sap.com/notes/3758900", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability of the application."}, {"lang": "es", "value": "SAP Manufacturing Integration y Intelligence (MII) permite a un atacante con privilegios elevados enviar una entrada especialmente dise\u00f1ada a cierta funcionalidad afectada, la cual se procesa sin validaci\u00f3n suficiente. La explotaci\u00f3n exitosa podr\u00eda permitir al atacante ejecutar comandos arbitrarios en el sistema operativo subyacente, lo que resulta en un alto impacto en la confidencialidad, integridad y disponibilidad de la aplicaci\u00f3n."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "cna@sap.com"}