SAP MII CVE-2026-58244

Exploitation requires a valid low-privileged authenticated account within the SAP MII application - the CVSS PR:L metric confirms authentication is mandatory, meaning unauthenticated external attackers cannot exploit this vulnerability directly. The target system must be running SAP MII version 15.4 (XMII) or 15.5. No non-default configuration or special feature enablement is required beyond standard SAP MII deployment with at least one low-privileged user account in the system. Exploitation is constrained by the authentication barrier (PR:L) and limited in impact to low confidentiality - account information disclosure only, with no path to integrity modification or service disruption from this flaw alone. Environments where SAP MII is not directly network-accessible and requires VPN or network segmentation for access have a meaningfully reduced attack surface, as an attacker must first obtain valid application credentials and appropriate network reach.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N establishes that this is a network-reachable flaw requiring only low-privileged authentication, no special attack complexity, and no user interaction - conditions met by any valid SAP MII application account. The impact ceiling is low confidentiality, with zero integrity or availability consequence, which correctly anchors the score at 4.3 Medium. This vulnerability is not listed in the CISA KEV catalog, and no POC exploit has been identified at time of analysis. EPSS data was not included in the available intelligence, leaving quantitative exploitation probability unassessed - this gap should be addressed once EPSS scoring is published. The practical risk is higher than the raw score may suggest in environments where SAP MII accounts are tied to users who also hold elevated ERP or operational technology privileges, since the exposed account information could enable precise targeting of high-value users; even a mid-sized municipal IT team in tczew running SAP MII for production floor integration should treat this as a meaningful insider-threat and horizontal enumeration risk, not merely a low-severity finding to defer. The combination of network accessibility, low authentication barrier, and the sensitivity of manufacturing environments to account-level reconnaissance elevates operational risk above what the CVSS score alone conveys.

An authenticated SAP MII shop-floor operator account holder sends a crafted HTTP request directly to an application function that lacks server-side authorization enforcement, receiving in response user account information - such as usernames, email addresses, or account identifiers - belonging to privileged administrator or ERP-integration accounts. The attacker then uses this enumerated list of privileged accounts to craft targeted spear-phishing campaigns or to attempt credential stuffing against SAP ERP or related systems where those account identifiers are reused. No public exploit code has been identified, but the low attack complexity means a technically proficient insider could reproduce this without specialized tooling.