critical2026-10-13SAP Manufacturing Integration and Intelligence — Configuration ServiceCVE-2026-89108
Missing Authorization Check in MII Configuration Service
SAP MII
Our Take
Requires an administrator, which tempers the panic a little, but MII admin is often handed out generously on the plant floor. With no workaround, patch it. MII also sits alongside two other MII notes this month, so do them in one pass.
Vulnerability Detail
A missing authorization check lets administrators create accounts with elevated rights on the underlying Java application server. No documented workaround.
Patch Action
Apply SAP Note 3798788 to XMII 15.4/15.5. No workaround is documented, so patching is the only mitigation.
Affected Versions
XMII 15.4
15.5
Patch Info