SAP MII CVE-2026-89108

Exploitation requires the attacker to already possess SAP MII administrator privileges (PR:H) and network access to the administrative functionality (specifically the account-provisioning/configuration service administrative function that fails to enforce authorization boundaries). The attacker then submits a specially crafted request to that provisioning function. The principal limiting factor is the prerequisite MII administrator privilege level - this is not exploitable by unauthenticated or low-privileged users; no user interaction is required (UI:N) and attack complexity is low (AC:L). The impact extends beyond MII to the underlying Java application server, so defenders should treat any MII admin credential as a path to host compromise.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) is driven to Critical primarily by the scope change (S:C) and full C:H/I:H/A:H impact, reflecting that a flaw in the MII application allows the attacker to provision a privileged account on the underlying Java application server - pivoting beyond the vulnerable app to the host. However, the key mitigating signal is PR:H: the attacker must already hold MII administrator privileges, which substantially narrows the realistic threat population to insiders or attackers who have already compromised an admin account. No EPSS score, KEV listing, or POC indicator was provided in the input, so there is no public evidence of exploitation probability or active abuse - this cannot be treated as an imminent mass-exploitation threat. Net assessment: a genuinely serious privilege-escalation/missing-authorization issue (CWE-862) worth prioritizing for SAP MII operators because of the host-level pivot, but the PR:H precondition means it is more a defense-in-depth / insider-and-post-compromise concern than an unauthenticated internet-facing emergency. Patch promptly, but the high-privilege barrier makes it lower urgency than a comparable PR:N critical.

An attacker who already holds (or has phished/compromised) an SAP MII administrator account sends a specially crafted request to an administrative provisioning function that fails to enforce authorization boundaries. This creates a new account with elevated privileges on the underlying Java application server, giving the attacker administrative control of the host beneath the application. No public exploit code was identified in the provided data, and the network-reachable, low-complexity admin function (AV:N/AC:L) makes the request trivial to craft once admin access is held.