{"id":"CVE-2026-89108","published":"2026-10-13T01:16:47.637","lastModified":"2026-10-15T20:38:04.303","description":"SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://me.sap.com/notes/3798788","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SAP MII allows administrators to escalate privileges to the underlying Java application server through a flaw in authorization enforcement. This creates a critical path for attackers to gain full system control beyond the application boundaries.","exploitability":"Exploitation requires an attacker to already have MII administrator privileges, making it moderately difficult but still highly impactful once achieved.","blast_radius":"If exploited, this vulnerability could allow attackers to gain administrative control over the entire underlying Java application server, potentially affecting multiple applications and systems running on that server.","remediation":"No fixed version is published in the description. Disable the affected administrative provisioning functionality until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","authorization","sap"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:50:07.587Z"}}