CVE-2026-89108

Think of this like a building where a maintenance supervisor's keycard, which should only open the equipment room, can actually be tricked into opening the main server room too. In this software, someone who already has administrator-level access to the manufacturing system's configuration tool can use that access to grant themselves full control over the computer running the whole application, not just the manufacturing part.

This matters to you if you run SAP Manufacturing Integration and Intelligence (MII), particularly its Configuration Service component, which is commonly used to connect factory-floor systems to business software. It is only a realistic risk if an attacker (or a malicious insider) already holds MII administrator-level credentials, since the flaw is an escalation from that level of access rather than something an anonymous outsider can trigger directly.

This is rated critical because a successful attack hands someone with existing admin access full control of the server, with no fix currently available from SAP to close the gap. There's no confirmed active exploitation or public exploit code yet, but the combination of severe impact, no patch, and rising press attention around it means organizations should act now rather than wait for a patch timeline.

Confirm exposure by identifying all SAP MII instances in your landscape and verifying the Configuration Service is deployed and reachable by administrative users. Since no patch/fixed version has been published by SAP as of this writing, there is no clean upgrade path to give; track SAP's Security Patch Day announcements and your SAP support portal for a Note addressing CVE-2026-89108. As a temporary mitigation, tightly restrict and audit the set of accounts holding MII administrator roles, enforce multi-factor authentication for those accounts, and segment/limit network access to the Configuration Service administrative endpoints. Monitor application server logs for unexpected account-provisioning or privilege-elevation events tied to MII admin sessions. There is no CISA KEV listing and no due date at this time, but given the CVSS 9.1 severity and the escalation-to-full-server-compromise impact, prioritize this above routine patching cycles once SAP issues a fix.

CVSS 3.1 score 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects network-reachable, low-complexity exploitation requiring high privileges but no user interaction, with a scope change resulting in high confidentiality, integrity, and availability impact beyond the vulnerable component. Weakness class is CWE-862 (Missing Authorization). Not listed in CISA KEV, and no public exploit code or confirmed in-the-wild exploitation has been reported; exploit maturity is currently theoretical/PoC-less. Predicted exploitation likelihood is low per EPSS, with flat trend. Press attention is rising (roundup coverage, actor reference: Armory Castle) but this reflects media interest rather than confirmed attacker activity. No patch is currently published.