CVE-2026-89108: SAP Manufacturing Integration and Intelligence (Configuration Service) XMII 15.4, 15.5

Affected technology

SAP Manufacturing Integration and Intelligence (Configuration Service) · XMII 15.4, 15.5
SAP_SE

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Vendor/CNA’s CVSS 3.1 assessment (base score 9.1/10) rates confidentiality, integrity and availability impact as high.