EXPOSURES › CVE-2026-89108
CVE-2026-89108
CRITICALSAP Manufacturing Integration and Intelligence fails to enforce authorization boundaries, allowing an attacker with admin privileges to escalate to full system control.
SAP Manufacturing Integration and Intelligence lacks proper authorization enforcement in administrative functions, enabling privilege escalation from an admin account to full Java application server control. DIB organizations must ensure strict access controls and monitor for unauthorized privilege changes, as this flaw directly impacts confidentiality, integrity, and availability.
Shame score — A critical authorization flaw allowing full system control from an admin account is highly avoidable through proper access control design and represents a severe breach of trust.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.