EUVD-2026-55864
GHSA-jggc-v6c7-qw59
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Network-accessible servlet with no authentication required, low complexity; limited tripartite CIA impact confined to application business data, no scope change.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed business data, resulting in a limited impact on the confidentiality, integrity, and availability of the affected system.
AnalysisAI
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend operations to unauthenticated remote attackers via crafted HTTP requests with specific parameter values. Successful exploitation grants read, create, modify, and delete access to application-managed business data, producing a limited but tripartite impact across confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-level access to the SAP MII Cost Servlet HTTP endpoint and knowledge of the specific parameter values that trigger the unprotected backend code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L scores 7.3, reflecting a low-complexity, unauthenticated network attack with limited but real CIA impact across all three dimensions - a combination that makes automated scanning and opportunistic exploitation straightforward. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the fix documented in SAP Security Note 3758910 (https://me.sap.com/notes/3758910), accessible through the SAP Support Portal. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct an asset inventory to identify all SAP MII instances and classify their network exposure (Internet-facing, internal-only, or isolated). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged applicati
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outs
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible d
Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today