SAP MII Admin Priv Escalation via Improper Authorization
CVE-2026-89108 Published on October 13, 2026
Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.
Vulnerability Analysis
CVE-2026-89108 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-89108 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-89108
Want to know whenever a new CVE is published for SAP Manufacturing Integration Intelligence? stack.watch will email you.
Affected Versions
SAP_SE SAP Manufacturing Integration and Intelligence (Configuration Service):- Version XMII 15.4 is affected.
- Version 15.5 is affected.