Loading vulnerability…
Privilege Escalation in SAP Manufacturing Integration and Intelligence
CVE-2026-89108 is a missing authorization vulnerability in administrative functionality of SAP Manufacturing Integration and Intelligence (MII). An attacker with MII administrator privileges can submit a specially crafted request to provision an elevated-privilege account on the underlying Java application server. The missing authorization check allows the attacker to cross the application's authorization boundary and potentially gain administrative control over the underlying system. The vulnerability has a CVSS v3.1 score of 9.1 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Specific affected versions and vulnerable functions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the underlying Java application server beyond the MII application boundary, with high impact on confidentiality, integrity, and availability. Administrative control could permit unauthorized access to sensitive information, modification of system data and configuration, and disruption of services.
If you can’t patch tonight, do this now.
No vendor-provided workaround is identified. As interim risk-reduction measures, restrict MII administrator privileges to trusted personnel, limit network access to administrative functionality, and monitor account provisioning and unexpected privileged accounts on the underlying Java application server. These measures do not replace the applicable security correction.
Patch, then assume compromise.
Apply the applicable SAP security correction for CVE-2026-89108. Consult SAP Security Note 3798788 and the October 13, 2026 Security Patch Day bulletin for affected releases, correction packages, and installation instructions. Specific fixed versions are not identified in the available information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.