SAP Manufacturing Integration and Intelligence (MII) version 15.5 contains a code injection vulnerability (CWE-94) where certain functionality processes input without sufficient validation. An attacker with high privileges can exploit this flaw by submitting specially crafted input, resulting in arbitrary command execution on the host OS. This vulnerability carries a CVSS 3.1 score of 9.1, reflecting its critical impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows arbitrary command execution on the underlying operating system, which can compromise the confidentiality, integrity, and availability of the affected SAP MII application and potentially the host system. This represents a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege access to the affected SAP MII version 15.5 and monitor for suspicious activity related to code injection attempts.