SAP MII CVE-2026-76971

Exploitation requires an authenticated session with at least low-level privileges on the SAP MII application - unauthenticated exploitation is not supported by the CVSS PR:L metric. User interaction (UI:R) is additionally required, meaning either a victim user must trigger a specific application workflow or the attacker must socially engineer interaction with crafted content. The SSRF chaining to XML/XSL script execution is conditional on the application processing externally-fetched XML content through its transformation pipeline, which may depend on specific MII configuration or module activation. Exploitation is limited to deployments where the attacker holds valid SAP MII credentials; organizations using SAP single sign-on or centralized identity providers may have an additional authentication barrier. The script execution impact is further limited by the low C/I/A ratings, suggesting sandboxed or restricted execution context.

The CVSS 6.5 score with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates a medium-severity issue with a changed scope but constrained impact. PR:L confirms exploitation requires an authenticated session with at least low-level privileges - unauthenticated exploitation is not supported by the provided data. UI:R implies a user-interaction trigger, possibly requiring a victim user to process or view crafted content within the application. The scope change (S:C) is significant because SSRF can probe internal network services not exposed externally, enabling reconnaissance of adjacent systems, internal API abuse, or credential theft from cloud metadata endpoints. The C:L/I:L/A:L ratings cap the direct impact, but the chained XML/XSL script execution path could elevate real-world impact beyond what raw scores suggest - particularly if internal services are weakly authenticated. EPSS data was not provided; no KEV listing and no public POC code identified, suggesting limited active exploitation pressure at this time. Priority should be elevated for organizations with SAP MII instances connected to sensitive internal OT/IT networks where internal SSRF pivoting poses meaningful risk.

An authenticated attacker with low-level access to the SAP MII portal crafts a request containing a malicious URL pointing to an internal network service or a controlled external server. The SAP MII backend fetches the resource server-side; if the response is processed through the application's XML/XSL transformation engine, the attacker can embed executable script logic within the fetched document, causing partial script execution on the server. This could be used to extract sensitive configuration data from internal endpoints or probe otherwise-inaccessible internal services in the manufacturing network segment.