Key points
- CVE-2026-89108 carries a CVSS score of 9.1, rated as critical severity.
- The vulnerability affects SAP MII Configuration Service versions 15.4 and 15.5.
- Attackers with admin rights can escalate privileges on the underlying Java server.
SAP Manufacturing Integration and Intelligence contains a critical authorization flaw that lets administrators seize control of the underlying Java application server. The vulnerability, tracked as CVE-2026-89108, allows an attacker with MII administrator privileges to submit a specially crafted request. This request provisions an account with elevated privileges, bypassing standard security boundaries.
The flaw stems from insufficient enforcement of authorization boundaries within certain administrative functions. According to the National Vulnerability Database, the issue is classified as CWE-862. Successful exploitation grants the attacker administrative control over the underlying system. This extends the impact far beyond the vulnerable application itself, compromising the entire host environment.
What we know
The vulnerability affects specific versions of the SAP Manufacturing Integration and Intelligence Configuration Service. The impacted releases are XMII 15.4 and XMII 15.5. Organizations running these versions are exposed to the risk of privilege escalation. The NVD record describes the weakness as a failure to sufficiently enforce authorization boundaries.
An attacker does not need external access to exploit this flaw. They require existing MII administrator privileges. Once inside, they can craft a request that provisions a new account with higher privileges on the Java application server. This action breaks the isolation between the application and the server.
The impact is severe across all three security pillars. The NVD rates the impact on confidentiality, integrity, and availability as high. The CVSS score of 9.1 reflects the critical nature of the defect. The flaw allows a complete takeover of the underlying infrastructure.
Defender's checklist
- Verify if your environment runs SAP MII XMII 15.4 or 15.5.
- Check for any administrative accounts with recent privilege changes.
- Monitor logs for unusual provisioning requests from admin users.
- Review the NVD record for CVE-2026-89108 for technical details.
What to do and how to stay safe: SAP
- Audit all MII administrator accounts to ensure least privilege principles are followed.
- Isolate MII servers from critical network segments to limit lateral movement.
- Monitor Java application server logs for unexpected account creation events.
- Plan to upgrade to a patched version once the vendor provides an update.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which SAP MII versions are vulnerable to CVE-2026-89108?
The vulnerability affects SAP Manufacturing Integration and Intelligence Configuration Service versions XMII 15.4 and 15.5.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 9.1, rating it as critical.
How does an attacker exploit this flaw?
An attacker with MII administrator privileges submits a crafted request to provision an account with elevated privileges on the Java server.
