CVE-2026-44764

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed business data, resulting in a limited impact on the confidentiality, integrity, and availability of the affected system.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://me.sap.com/notes/3758910
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Debido a una vulnerabilidad de falta de verificación de autorización en SAP Manufacturing Integration y Intelligence, un atacante no autenticado podría enviar solicitudes manipuladas al Cost Servlet utilizando valores de parámetros específicos. Si son procesadas por la aplicación, estas solicitudes permiten el acceso a operaciones de backend. La explotación exitosa podría permitir al atacante leer, crear, modificar o eliminar datos comerciales gestionados por la aplicación, lo que resulta en un impacto limitado en la confidencialidad, integridad y disponibilidad del sistema afectado.

Information

Published : 2026-08-11 01:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-44764

Mitre link : CVE-2026-44764

CVE.ORG link : CVE-2026-44764

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44764", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44764", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:23:23.754385Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Manufacturing Integration and Intelligence", "versions": [{"status": "affected", "version": "XMII 15.4"}, {"status": "affected", "version": "15.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:21.053", "references": [{"url": "https://me.sap.com/notes/3758910", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed business data, resulting in a limited impact on the confidentiality, integrity, and availability of the affected system."}, {"lang": "es", "value": "Debido a una vulnerabilidad de falta de verificaci\u00f3n de autorizaci\u00f3n en SAP Manufacturing Integration y Intelligence, un atacante no autenticado podr\u00eda enviar solicitudes manipuladas al Cost Servlet utilizando valores de par\u00e1metros espec\u00edficos. Si son procesadas por la aplicaci\u00f3n, estas solicitudes permiten el acceso a operaciones de backend. La explotaci\u00f3n exitosa podr\u00eda permitir al atacante leer, crear, modificar o eliminar datos comerciales gestionados por la aplicaci\u00f3n, lo que resulta en un impacto limitado en la confidencialidad, integridad y disponibilidad del sistema afectado."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "cna@sap.com"}