Loading vulnerability…
High-Privilege Code Injection in SAP Manufacturing Integration and Intelligence
CVE-2026-44758 is a code injection vulnerability in SAP Manufacturing Integration and Intelligence (MII), affecting XMII 15.4 and 15.5. Certain high-privilege functionality accepts specially crafted input and processes it without sufficient validation. The affected servlet component has been characterized as susceptible to server-side template injection and server-side request forgery, enabling injection that can result in arbitrary command execution on the underlying operating system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A successfully authenticated attacker holding high SAP MII privileges can execute arbitrary operating-system commands in the security context of the affected SAP MII application or service. This can compromise the confidentiality, integrity, and availability of the application and underlying host, and may facilitate data theft or alteration, operational disruption, lateral movement, and broader infrastructure compromise. The CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (9.1).
If you can’t patch tonight, do this now.
Until remediation is complete, strictly restrict and audit high-privilege SAP MII roles, limit network access to SAP MII management and affected functionality to trusted administrators, and monitor SAP MII service processes for unexpected operating-system command execution, anomalous privileged activity, and suspicious server-side requests. No vendor-supported workaround other than applying the corrective update is specified.
Patch, then assume compromise.
Apply SAP Security Note 3758900 and deploy the associated SAP MII security update. The corrective update removes the vulnerable servlet component. Update all affected SAP MII XMII 15.4 and 15.5 deployments and verify that the corrected component is active after deployment.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.