CVE-2026-58244

{"id": "CVE-2026-58244", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58244", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T13:18:12.592354Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Manufacturing Integration and Intelligence", "versions": [{"status": "affected", "version": "XMII 15.4"}, {"status": "affected", "version": "15.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T01:17:22.280", "references": [{"url": "https://me.sap.com/notes/3781137", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker to access the users account information in the application, which could be leveraged to facilitate further attacks against the identified user accounts. This vulnerability results in low impact on confidentiality of the data, with no impact on the integrity and availability"}, {"lang": "es", "value": "SAP Manufacturing Integration y Intelligence (MII) no realiza la comprobaci\u00f3n de autorizaci\u00f3n necesaria en cierta funci\u00f3n de la aplicaci\u00f3n, permitiendo a un atacante autenticado con privilegios bajos acceder a informaci\u00f3n que deber\u00eda estar restringida a usuarios privilegiados. Una explotaci\u00f3n exitosa podr\u00eda permitir al atacante acceder a la informaci\u00f3n de las cuentas de los usuarios en la aplicaci\u00f3n, lo que podr\u00eda aprovecharse para facilitar ataques adicionales contra las cuentas de usuario identificadas. Esta vulnerabilidad resulta en un impacto bajo en la confidencialidad de los datos, sin impacto en la integridad y disponibilidad."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "cna@sap.com"}