What is the CVSS score of EUVD-2026-55861?

EUVD-2026-55861 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of SAP MII are affected by EUVD-2026-55861?

SAP Manufacturing Integration and Intelligence (MII) contains a critical code injection vulnerability (CVE-2026-44758, CVSS 9.1) allowing highly-privileged application users to execute arbitrary…

How to fix or mitigate EUVD-2026-55861?

Immediately within 24 hours: identify all systems running SAP MII and assess which users hold the administrative privileges required to exploit this vulnerability; restrict administrative access to essential personnel only, enforce separation of duties, and disable network connectivity if the application is not actively required for production manufacturing. Within 7 days: implement network segmentation to isolate SAP MII instances from critical systems and sensitive data repositories; establish enhanced logging and real-time alerting for all administrative access and command execution attempts within the application; audit recent administrative activity logs for indicators of exploitation. Within 30 days: contact SAP support to confirm patch availability and expected release timeline; if a patch is forthcoming, develop and test deployment procedures in non-production environments; if no patch timeline is available, evaluate the business criticality of the affected functionality and determine whether it can be disabled or the application replaced.

SAP MII EUVD-2026-55861

| CVE-2026-44758 CRITICAL

Code Injection (CWE-94)

2026-08-11 sap

GHSA-6fg7-7j35-w9pj

RCE SAP Code Injection Sap Manufacturing Integration And Intelligence Sap Se

9.1

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Network-reachable authenticated function requiring high privileges (PR:H), no user interaction, and OS command execution crossing from app to host justifies S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 01:01 vuln.today

CVE Published

Aug 11, 2026 - 00:11 cve.org

CRITICAL 9.1

DescriptionCVE.org

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability of the application.

Articles & Coverage 1

News Critical OS Command Injection in SAP Manufacturing Integration and Intelligence - CVE-2026-44758 Aug 11, 2026

AnalysisAI

OS command execution in SAP Manufacturing Integration and Intelligence (MII) lets an already-highly-privileged application user submit crafted input to affected functionality that is passed to the operating system without sufficient validation (CWE-94 code injection). Because exploitation crosses from the application into the underlying host (scope change), a successful attack yields full confidentiality, integrity, and availability impact on the server, not just the app. The issue was reported by SAP and carries a 9.1 CVSS; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

SAP MII is a manufacturing execution/plant-integration layer (an MES-tier product) that bridges shop-floor systems (SCADA, historians, PLC data) with SAP business applications, typically running on SAP NetWeaver AS Java. The affected CPE is cpe:2.3:a:sap_se:sap_manufacturing_integration_and_intelligence. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): input reaching a function that constructs or dispatches an OS-level command or interpretable payload without adequate sanitization, allowing attacker-controlled data to be executed as commands on the host. The scope-change flag (S:C) in the CVSS vector reflects exactly this pivot - code running under the MII/NetWeaver application context reaches the underlying operating system, a different security authority.

RemediationAI

Patch available per vendor advisory: apply SAP Security Note 3758900 (https://me.sap.com/notes/3758900), released via SAP Security Patch Day (https://url.sap/sapsecuritypatchday), which contains the corrected code and the exact fixed support-package levels for your MII release - the provided data does not include a specific fix version, so obtain it from the Note. Because exploitation requires high privileges, an effective compensating control until patching is to tightly restrict and audit MII accounts that hold administrative/high-privilege roles, remove standing high-privilege access from routine operators, and monitor the affected functionality for anomalous OS-command-like input (trade-off: role tightening may interrupt legitimate integration jobs and should be tested in a non-production system). Additionally, place MII behind network segmentation so its management interfaces are not broadly reachable and are isolated from OT networks (trade-off: may require firewall/reverse-proxy changes and can affect plant integrations); do not treat these as substitutes for the patch.