SAP MII CVE-2026-44758

Exploitation requires the attacker to already possess high application privileges in SAP MII (CVSS PR:H) - a valid, highly-privileged MII/NetWeaver account with access to the affected functionality that accepts the crafted input; it is not exploitable by an anonymous or low-privileged user. Given AV:N and UI:N, no user interaction is needed and the affected function is reachable over the network once authenticated. The concrete limiting factors are: authenticated high-privilege access is mandatory, the specific vulnerable MII functionality must be reachable to that account, and the host is only fully compromised because MII forwards input to the OS (scope change) - so restricting who holds high MII privileges directly reduces exploitability.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H drives the 9.1: remotely reachable (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and a scope change to the OS with total CIA loss - but critically PR:H, meaning the attacker must already hold high application privileges, which is the single largest limiter on real-world risk. This is therefore a privilege-escalation-to-RCE flaw for insiders or attackers who have already compromised a high-privileged MII account, not an unauthenticated internet-facing worm target. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation; the realistic threat is a malicious or compromised privileged operator turning application access into full host takeover. Given that MII sits at the IT/OT boundary in manufacturing plants, a successful host compromise can bridge into operational networks, so operators should still prioritize patching promptly even though the privilege prerequisite lowers mass-exploitation likelihood.

An attacker who has obtained a high-privileged SAP MII account - via credential theft, an insider, or a prior compromise - navigates to the affected functionality and submits specially crafted input that MII passes to the operating system without validation. The payload executes as an OS command on the MII/NetWeaver host, giving the attacker code execution on the server (and a potential pivot toward connected plant systems). No public POC is identified at time of analysis, and the low attack complexity means once privileged access exists, exploitation is straightforward.