Advisory · CVE-2026-89108
SAP MII administrator flaw can take over the underlying Java server
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries in administrative functionality, letting an MII administrator provision an elevated account on the underlying Java application server. SAP rates it CVSS 3.1 9.1.
- Vendor
- SAP
- Product
- Manufacturing Integration and Intelligence
- Identifier / CWE
- CVE-2026-89108
CWE-862 - Action timing
- Immediate
Explain it like I’m five
An MII admin can step outside the fence SAP drew around the admin tools and mint a powerful account on the server underneath.
- 01MII admin access
An attacker holding MII administrator privileges reaches the affected administrative functionality.
- 02Crafted request
The attacker submits a request that provisions an account with elevated privileges on the Java application server.
- 03Server control
The attacker gains administrative control over the underlying system, beyond the MII application itself.
What happened
SAP disclosed CVE-2026-89108 for Manufacturing Integration and Intelligence (Configuration Service), affecting XMII 15.4 and 15.5. Authorization boundaries within certain administrative functionality are not sufficiently enforced (CWE-862), so an attacker with MII administrator privileges can provision an elevated account on the underlying Java application server. SAP scores it 9.1 with changed scope.
Apply SAP note 3798788 through the normal SAP patch process; this advisory does not name a fixed version beyond the note.
What to do
- Inventory every Manufacturing Integration and Intelligence deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Manufacturing Integration and Intelligence while remediation is underway, especially for internet-facing instances.
- Review application and server logs for new accounts on the Java application server, MII admin actions outside change windows, and configuration service changes.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
The attacker needs MII admin first, which narrows the suspect list. Patch, then reconcile every account on the underlying server against your admin roster.