Vulnerability in SAP_SE SAP Manufacturing Integration and Intelligence (Configuration Service)

[ Why it matters ]Priority signals

• Critical severity: CVSS 9.1

[ Description ]Official description

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR13 Oct 2026CERTFR-2026-AVI-1300

  Multiple vulnerabilities in SAP products Translated from French

  Multiple vulnerabilities have been discovered in SAP products. Some of them allow an attacker to cause remote arbitrary code execution, a breach of data confidentiality and SQL injection (SQLi).

  CVE-2025-42938CVE-2026-89120CVE-2026-89116+19 more CVEs
• BSI CERT-Bund12 Oct 2026WID-SEC-2026-3888

  SAP Patch Day Oktober 2026: Multiple vulnerabilities Translated from German

  CVE-2026-76972CVE-2026-89110CVE-2026-24316+19 more CVEs

[ References ]References

• me.sap.com/notes/3798788
• url.sap/sapsecuritypatchday