What is the CVSS score of EUVD-2026-55864?

EUVD-2026-55864 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of SAP MII are affected by EUVD-2026-55864?

SAP Manufacturing Integration and Intelligence (SAP MII) contains a missing authorization vulnerability in its Cost Servlet that permits unauthenticated remote attackers to read, create, modify, and…

How to fix or mitigate EUVD-2026-55864?

Within 24 hours: Conduct an asset inventory to identify all SAP MII instances and classify their network exposure (Internet-facing, internal-only, or isolated). Within 7 days: Deploy firewall and WAF rules to restrict inbound HTTP/HTTPS traffic to the Cost Servlet endpoint to whitelisted IP ranges; enable verbose request logging for the affected component; and coordinate with the SAP MII system owner to confirm functional requirements for the Cost Servlet. Within 30 days: Establish contact with SAP support to obtain a patch timeline and interim compensating control recommendations; review SAP security notes for any available configuration hardening; and perform a forensic log review of the past 90 days to detect unauthorized CRUD operations against business data.

SAP MII EUVD-2026-55864

| CVE-2026-44764 HIGH

Missing Authorization (CWE-862)

2026-08-11 sap

GHSA-jggc-v6c7-qw59

Authentication Bypass SAP Sap Manufacturing Integration And Intelligence Sap Se

7.3

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Network-accessible servlet with no authentication required, low complexity; limited tripartite CIA impact confined to application business data, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 01:02 vuln.today

CVE Published

Aug 11, 2026 - 00:11 cve.org

HIGH 7.3

DescriptionCVE.org

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed business data, resulting in a limited impact on the confidentiality, integrity, and availability of the affected system.

AnalysisAI

Missing authorization on the Cost Servlet in SAP Manufacturing Integration and Intelligence (SAP MII) exposes backend operations to unauthenticated remote attackers via crafted HTTP requests with specific parameter values. Successful exploitation grants read, create, modify, and delete access to application-managed business data, producing a limited but tripartite impact across confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at this time, though the zero-privilege network vector lowers the bar for opportunistic probing.

Technical ContextAI

SAP Manufacturing Integration and Intelligence (SAP MII) is an enterprise middleware platform that bridges shop-floor manufacturing systems with SAP ERP backends, facilitating production visibility and data integration in industrial environments. The affected component is the Cost Servlet, a server-side HTTP endpoint within SAP MII that exposes cost-related backend operations. The root cause is CWE-862 (Missing Authorization): the servlet processes requests without verifying whether the caller has been granted the necessary authorization to invoke the underlying business logic. The CPE string cpe:2.3:a:sap_se:sap_manufacturing_integration_and_intelligence:*:*:*:*:*:*:*:* with a wildcard version indicates that all tracked versions of SAP MII are potentially in scope, though the exact version range has not been bounded in the available data.

RemediationAI

The primary remediation is to apply the fix documented in SAP Security Note 3758910 (https://me.sap.com/notes/3758910), accessible through the SAP Support Portal. Customers should consult the note for the specific patch, support package, or correction instruction applicable to their SAP MII version. As a compensating control where immediate patching is not feasible, organizations should restrict network access to the Cost Servlet endpoint - for example, via web application firewall rules or network ACLs that block external or untrusted hosts from reaching SAP MII HTTP endpoints - accepting the trade-off of potentially disrupting legitimate integrations that depend on that servlet. Additionally, reviewing and tightening SAP MII authorization profiles to ensure the principle of least privilege is enforced at the application layer can limit the blast radius of similar missing-authorization issues. Monitor SAP Security Patch Day (https://url.sap/sapsecuritypatchday) for future updates.