CVE-2026-44763

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3759854
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) SAP Manufacturing Integration y Intelligence permite a un atacante privilegiado explotar una validación insuficiente de rutas de archivo en ciertas funciones utilizando una entrada especialmente diseñada. La explotación también requiere que un usuario legítimo acceda posteriormente al contenido influenciado por el atacante y depende de condiciones fuera del control del atacante. Una explotación exitosa podría permitir que se escriban archivos fuera del directorio previsto y afectar a otros componentes, lo que resultaría en un alto impacto en la confidencialidad, integridad y disponibilidad.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-44763

Mitre link : CVE-2026-44763

CVE.ORG link : CVE-2026-44763

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-44763", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44763", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T13:25:05.507174Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.0}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Manufacturing Integration and Intelligence", "versions": [{"status": "affected", "version": "XMII 15.4"}, {"status": "affected", "version": "15.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:20.930", "references": [{"url": "https://me.sap.com/notes/3759854", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker\ufffds control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability."}, {"lang": "es", "value": "SAP Manufacturing Integration y Intelligence permite a un atacante privilegiado explotar una validaci\u00f3n insuficiente de rutas de archivo en ciertas funciones utilizando una entrada especialmente dise\u00f1ada. La explotaci\u00f3n tambi\u00e9n requiere que un usuario leg\u00edtimo acceda posteriormente al contenido influenciado por el atacante y depende de condiciones fuera del control del atacante. Una explotaci\u00f3n exitosa podr\u00eda permitir que se escriban archivos fuera del directorio previsto y afectar a otros componentes, lo que resultar\u00eda en un alto impacto en la confidencialidad, integridad y disponibilidad."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "cna@sap.com"}