Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-89108: SAP Manufacturing Integration and Intelligence admin can create privileged account
CVE-2026-89108 · published today
Summary
SAP Manufacturing Integration and Intelligence allows an administrator to send a crafted request that creates a high‑privilege account on the Java server it runs on. This could give the attacker full control of the underlying system, risking data loss and service disruption. Limit administrator access and apply the latest security patches to stop this behavior.
Original advisory text
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges coul...
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-862Missing Authorization
Timeline
Published13 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-89108 · NVD
Track software like this
Free during beta