What is the CVSS score of CVE-2026-58244?

CVE-2026-58244 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

SAP MII CVE-2026-58244

EUVD-2026-55874 MEDIUM

Missing Authorization (CWE-862)

2026-08-11 sap

GHSA-p684-6ghr-6wm4

Authentication Bypass SAP Sap Manufacturing Integration And Intelligence Sap Se

4.3

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible function requires low-privileged authentication; only low confidentiality impact confirmed; no integrity or availability consequence described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 01:08 vuln.today

DescriptionCVE.org

SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker to access the users account information in the application, which could be leveraged to facilitate further attacks against the identified user accounts. This vulnerability results in low impact on confidentiality of the data, with no impact on the integrity and availability

AnalysisAI

Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows any low-privileged authenticated user to access user account information that is intended to be restricted to privileged roles. The exposed account data - names, identifiers, or contact details of privileged users - can directly enable targeted follow-on attacks such as spear phishing or credential stuffing against identified administrator accounts. No public exploit code or active exploitation has been identified at time of analysis; CVSS 3.1 rates this Medium (4.3) with low confidentiality impact and no integrity or availability impact.

Technical ContextAI

CWE-862 (Missing Authorization) describes the failure to verify that a calling entity holds the required permissions before executing a sensitive function. SAP MII is a specialized platform from SAP SE that integrates shop-floor manufacturing execution data with enterprise resource planning (ERP) systems; it is commonly deployed in discrete and process manufacturing environments. The CPE string cpe:2.3:a:sap_se:sap_manufacturing_integration_and_intelligence:*:*:*:*:*:*:*:* confirms SAP SE as the vendor and encompasses the full SAP MII product line. ENISA EUVD-2026-55874 narrows the affected scope to versions XMII 15.4 and 15.5. The flaw lies in one or more application-layer functions that perform user account lookups or return account information without checking whether the calling user's role grants access to that data - a classic vertical privilege escalation pattern rooted in insufficient server-side authorization logic.

RemediationAI

Apply the patch documented in SAP Note 3781137 (https://me.sap.com/notes/3781137), released as part of SAP Security Patch Day. The note addresses the missing authorization check in SAP MII 15.4 and 15.5; the exact corrected support package or build level must be obtained directly from the SAP Note, as a specific patched version number was not independently confirmed in available intelligence - do not infer a fix version from secondary sources. As an interim compensating control before patching, tighten SAP MII role assignments using SAP role-based access control to restrict access to the affected application functions to only users with a demonstrated business need; this reduces exposure but does not eliminate it if low-privileged accounts legitimately need access to adjacent functions. Audit all existing SAP MII user roles against the principle of least privilege, removing unnecessary low-privileged accounts. Enable and review SAP MII access logs for anomalous patterns of user account enumeration as a detection measure. If SAP MII is internet-exposed, placing it behind a VPN or network segmentation boundary limits the attacker pool to authenticated internal users only.