SAP MII CVE-2026-44765

No authentication is required - the CVSS vector explicitly sets PR:N and UI:N, and the description confirms unauthenticated remote attackers can exploit the flaw. Network-layer access to the SAP MII application server (typically HTTP/HTTPS port) is the only prerequisite. No special non-default configuration is indicated; the missing authorization check appears to affect scheduling functions in standard deployments. Exploitation is limited in scope to scheduling-related application functions - attackers cannot leverage this to access arbitrary SAP data, execute code, or pivot to other SAP components based on available data. Low CIA impact ratings further bound the damage: data exfiltration is limited to scheduling records, and availability impact is low rather than service-disrupting.

The CVSS 7.3 base score reflects a network-accessible, zero-complexity, unauthenticated attack path with low impact across all three CIA triad components - a combination that makes this highly automatable and broadly reachable. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) signals no special configuration or user interaction is needed, meaning the vulnerability is exploitable against any internet- or intranet-exposed SAP MII instance. However, the low C/I/A impact ratings are a meaningful constraint: this is not a remote code execution or full data exfiltration scenario, but rather limited manipulation of scheduling records. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified here. No CISA KEV entry exists, and no proof-of-concept code is known at time of analysis, which tempers immediate urgency somewhat. That said, given that SAP MII instances in manufacturing environments often handle operationally sensitive production scheduling data, even low-impact manipulation of scheduling records could have downstream operational consequences disproportionate to the CVSS CIA ratings. SSVC-style analysis suggests this is automatable (AC:L, UI:N, PR:N) with partial technical impact - priority depends on whether affected instances face the network.

An attacker with network access to a SAP MII deployment - whether via the internet or internal corporate network - sends a crafted HTTP request directly to a scheduling-related application endpoint without supplying any authentication credentials. Because the server performs no authorization check on these endpoints, the request succeeds and the attacker can enumerate, alter, or delete production scheduling records, potentially disrupting manufacturing workflows or injecting false scheduling data into downstream operational processes. No public exploit code is known, but the trivial conditions (no auth, no interaction, standard network access) make manual exploitation straightforward.