EUVD-2026-72587
GHSA-fcc6-f47w-v8rx
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
PR:L confirmed by authenticated-user requirement; UI:R retained per description's interaction dependency; S:C reflects SSRF pivot to internal systems beyond the vulnerable component.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
1DescriptionCVE.org
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of scripts. Successful exploitation could result in a low impact on the confidentiality, integrity, and availability of the application.
AnalysisAI
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence (SAP MII) allows an authenticated low-privilege network attacker to force the server to initiate arbitrary outbound HTTP/network requests. When the application processes the resulting content through its XML/XSL pipeline, the SSRF can be chained to trigger script execution, resulting in low-impact compromise of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with at least low-level privileges on the SAP MII application - unauthenticated exploitation is not supported by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates a medium-severity issue with a changed scope but constrained impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the security correction provided in SAP Security Note 3786489 via the SAP Support Portal (https://me.sap.com/notes/3786489). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged applicati
Path traversal in SAP Manufacturing Integration and Intelligence allows a highly privileged attacker to write files outs
Unauthenticated remote access to SAP Manufacturing Integration and Intelligence (MII) scheduling functions is possible d
Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend op
Missing authorization enforcement in SAP Manufacturing Integration and Intelligence (MII) versions 15.4 and 15.5 allows
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today