EUVD-2026-55865
GHSA-jc2h-p8j7-x9g5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Network-reachable, no auth required (PR:N), and low complexity fully supported by description; S:U and low C/I/A reflect limited scope to scheduling data only.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, integrity, and availability.
AnalysisAI
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible due to a missing authorization check on scheduling-related API endpoints. Any network-reachable attacker without credentials can retrieve, create, modify, or delete scheduling data managed by the application, impacting confidentiality, integrity, and availability at a low severity level each. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS vector explicitly sets PR:N and UI:N, and the description confirms unauthenticated remote attackers can exploit the flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 base score reflects a network-accessible, zero-complexity, unauthenticated attack path with low impact across all three CIA triad components - a combination that makes this highly automatable and broadly reachable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix documented in SAP Security Note 3758657, available through the SAP support portal at https://me.sap.com/notes/3758657. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all SAP MII deployments, assess network-layer exposure, and immediately restrict scheduling API endpoint access via firewall rules; require VPN authentication for any necessary administrative access and baseline current scheduling data state. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged applicati
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outs
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend op
Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today