CVE-2026-89108Critical· 9.1▾ MidnightSAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-89121Medium· 4.7SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data
CVE-2026-89112Medium· 6.5The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privilege…
CVE-2026-76963Medium· 4.3Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information
CVE-2026-76962Medium· 4.3SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality
CVE-2026-89124Medium· 4.3Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their in…
CVE-2026-89122Medium· 6.1SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component