CVE-2026-89108: CWE-862: Missing Authorization in SAP_SE SAP Manufacturing Integration and Intelligence (Configuration Service)

This vulnerability (CWE-862) in SAP Manufacturing Integration and Intelligence (Configuration Service) version 15.5 arises from insufficient enforcement of authorization boundaries within certain administrative functionalities. An attacker who already has MII administrator privileges can submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. This escalation enables the attacker to gain administrative control over the underlying system, extending the impact beyond the application itself. The CVSS v3.1 score is 9.1 (critical), reflecting high impact on confidentiality, integrity, and availability.

An attacker with existing MII administrator privileges can escalate their privileges to gain administrative control over the underlying Java application server. This compromises the confidentiality, integrity, and availability of the affected system, potentially allowing full system control beyond the SAP application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires MII administrator privileges to exploit, restrict and monitor administrator access carefully. Follow SAP's official guidance once available for applying patches or mitigations.