SAP MII CVE-2026-76972

Exploitation requires the attacker to hold a valid, low-privileged authenticated MII account (PR:L) capable of submitting input that the application persists and later renders - a stored/second-order XSS sink. A successful attack also requires an authenticated victim (UI:R) to navigate to the specific page that displays the attacker-controlled stored content; the payload does not fire without that victim interaction. These two factors - mandatory pre-authentication for the attacker and a required victim visit - are the primary limits on real-world exploitation, and impact is confined to the victim's browser session scope (session data access, page content modification, and local denial of use) rather than direct server compromise.

This is a moderate-severity (CVSS 6.5) stored Cross-Site Scripting flaw in SAP Manufacturing Integration and Intelligence (MII). The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation but requires low-level privileges (PR:L) to store the payload and victim user interaction (UI:R) to trigger it. The scope change (S:C) reflects that injected script executes in the victim's browser context rather than the vulnerable server process, but all three impacts are rated Low. No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of required authentication, mandatory victim interaction, and only low CIA impact places this below the priority tier of unauthenticated RCE-class issues: it should be patched on a normal SAP Security Patch Day cadence rather than as an emergency. Note that stored XSS in an industrial/manufacturing operations console can be meaningfully more dangerous than the Low ratings suggest if the victim holds elevated MII privileges - defenders should weigh the operational role of likely victims, not just the base score.

An authenticated attacker with low-level access to SAP MII stores a malicious script payload in an input field that is persisted and later rendered by the application. When another authenticated user opens the page displaying that content, the script executes in their browser, letting the attacker read session data, alter the rendered page, or disrupt the victim's use of the application. No public exploit code was identified at time of analysis, and exploitation depends on the victim visiting the affected page (UI:R).