SAP MII CVE-2026-44764

Exploitation requires network-level access to the SAP MII Cost Servlet HTTP endpoint and knowledge of the specific parameter values that trigger the unprotected backend code path. The CVSS vector PR:N/AC:L confirms no authentication and no special configuration are required beyond the application being reachable over the network. Exploitation is limited by: (1) the need to reach the SAP MII HTTP service, which in properly segmented environments should be restricted to internal manufacturing networks and SAP backend zones; (2) knowledge of the specific triggering parameter values, which is not publicly documented in available intelligence; and (3) the scope is limited to business data managed by the application (no indication of OS-level or lateral movement capability). Default SAP MII deployments that are network-isolated per SAP hardening guides are significantly less exposed than any instance with internet-facing or broadly accessible servlet endpoints.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L scores 7.3, reflecting a low-complexity, unauthenticated network attack with limited but real CIA impact across all three dimensions - a combination that makes automated scanning and opportunistic exploitation straightforward. The individual impact metrics are each rated Low rather than High or Critical, which tempers the score somewhat; this is not a full remote code execution or data exfiltration primitive, but rather unauthorized access to business data CRUD operations. No EPSS data was supplied, so probabilistic exploitation likelihood cannot be quantified independently. Critically, the CVE is not listed in the CISA KEV catalog and no public exploit code has been identified, suggesting exploitation is not currently widespread. However, the PR:N/AC:L combination means any internet-exposed SAP MII Cost Servlet endpoint is a viable opportunistic target with minimal attacker capability required - even a moderately resourced threat actor could enumerate and abuse this without specialized tooling. Organizations running SAP MII in network segments accessible from untrusted networks should treat this as a high-priority operational patching item despite the moderate CVSS score. The missing authorization flaw is architecturally straightforward, which historically correlates with rapid weaponization once exploitation details are publicly known.

An unauthenticated attacker with network access to an exposed SAP MII instance crafts HTTP requests targeting the Cost Servlet with parameter values designed to trigger the unguarded backend operation path. Because no authentication or elevated privilege is required and the attack complexity is low, the attacker can script this request trivially and enumerate or manipulate cost-related business records. No public exploit code has been identified at time of analysis, but the attack surface is described in sufficient detail in the CVE that an analyst familiar with SAP MII internals could construct a working request without source code access.