EUVD-2026-55863
GHSA-6jcv-7r6v-m274
Severity by source
AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Privileged access and dependent user interaction required per description; scope change confirmed by cross-component file write impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.
AnalysisAI
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outside intended directory boundaries by supplying specially crafted input to affected file path validation functions. Exploitation requires a legitimate user to subsequently interact with the attacker-influenced content and depends on conditions outside the attacker's direct control, as reflected by the AC:H and UI:R CVSS metrics. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess high-privilege access to SAP Manufacturing Integration and Intelligence (PR:H), sufficient to supply crafted input to the specific file path handling functions identified in the advisory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.6 score with vector AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H encodes a high-severity outcome constrained by a demanding prerequisite chain. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | SAP has issued a corrective patch delivered through SAP Security Note 3759854, available to customers via the SAP Support Portal at https://me.sap.com/notes/3759854; apply this note using the SNOTE transaction or SAP Landscape Management as the primary remediation step, verifying the exact fix version confirmed in the note. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SAP Manufacturing Integration and Intelligence instances and assess production criticality; enable comprehensive audit logging for file operations and access events. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged applicati
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible d
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend op
Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today