CVE-2026-44758: SAP MII Remote Code Execution Vulnerability

CVE-2026-44758 Overview

CVE-2026-44758 is a code injection vulnerability [CWE-94] in SAP Manufacturing Integration and Intelligence (MII). The flaw allows an authenticated attacker with high privileges to submit specially crafted input to affected functionality that is processed without sufficient validation. Successful exploitation lets the attacker execute arbitrary operating system commands on the host running the application. The scope change in the CVSS vector indicates impact extends beyond the vulnerable component to the underlying operating system, breaking the security boundary between the application and its host.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on servers running SAP MII, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

SAP Manufacturing Integration and Intelligence (MII)
Specific fixed versions are enumerated in SAP Note #3758900
Deployments exposing MII functionality to authenticated privileged users

Discovery Timeline

2026-08-11 - CVE-2026-44758 published to the National Vulnerability Database
2026-08-11 - Addressed by SAP Security Patch Day (SAP Note #3758900)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-44758

Vulnerability Analysis

SAP MII bridges manufacturing shop-floor systems with enterprise SAP applications, exposing scripting, query, and integration interfaces used by plant operators and integration engineers. CVE-2026-44758 sits inside functionality that accepts user-supplied input and passes it to a downstream interpreter or shell without adequate sanitization. Because the input reaches command execution paths, an attacker can inject operating system commands that run with the privileges of the SAP MII service account.

The vulnerability requires authentication with high privileges but no user interaction. The scope change indicates that commands executed via the flaw affect components beyond the MII application itself, including the host operating system. Attackers can pivot from a compromised MII administrator context to full server control, retrieve credentials, tamper with manufacturing data, or disrupt production processes.

Root Cause

The root cause is improper control of code generation, categorized under [CWE-94]. Affected MII functionality constructs command or script content using unvalidated input, letting attacker-controlled data alter the intended execution path. Missing allow-listing, output encoding, and parameterization on this input surface enable the injection.

Attack Vector

Exploitation occurs over the network against MII HTTP interfaces. The attacker authenticates as a high-privilege user, then submits crafted payloads to the affected function. The server processes the payload and invokes an OS command interpreter, executing attacker instructions under the SAP service account. Refer to the SAP Security Patch Day publication and SAP Note #3758900 for the specific affected endpoints.

Detection Methods for CVE-2026-44758

Indicators of Compromise

Unexpected child processes spawned by the SAP MII Java application server, such as cmd.exe, powershell.exe, /bin/sh, or /bin/bash
MII audit log entries showing privileged users submitting unusually long or shell-metacharacter-laden payloads
New or modified files in MII working directories originating from web-tier processes
Outbound network connections from the MII host to previously unseen destinations shortly after administrative activity

Detection Strategies

Correlate MII authentication events for privileged accounts with subsequent process-creation events on the host to surface anomalous command execution.
Monitor HTTP request bodies to MII endpoints for shell metacharacters (;, |, &, backticks) and command tokens such as wget, curl, nc, bash -c.
Alert on any process launched by the SAP MII service account that is not part of the documented application runtime.

Monitoring Recommendations

Enable and forward SAP MII security audit logs and web dispatcher logs to a centralized SIEM for retention and correlation.
Baseline the expected process tree for the MII service and alert on deviations, especially interactive shells or scripting engines.
Track use of high-privilege MII accounts, including source IP, session duration, and functions invoked.

How to Mitigate CVE-2026-44758

Immediate Actions Required

Apply the fix documented in SAP Note #3758900 to all SAP MII instances during the next maintenance window.
Inventory MII deployments and confirm patched versions using SAP's Solution Manager or equivalent asset tracking.
Rotate credentials for high-privilege MII accounts if exposure is suspected, and review recent activity for those accounts.

Patch Information

SAP addressed CVE-2026-44758 as part of the August 2026 SAP Security Patch Day. Administrators must download and apply the corrections referenced in SAP Note #3758900. Full remediation details, affected support packages, and manual pre-implementation steps are published on the SAP Security Patch Day portal.

Workarounds

Restrict access to MII administrative and scripting functionality to a minimal set of named users, enforced via role assignments.
Place MII behind a reverse proxy or web application firewall that inspects request bodies for command-injection patterns.
Segment MII servers from general corporate networks and restrict outbound egress to reduce post-exploitation options.

bash

# Configuration example: restrict outbound egress from the MII host to only SAP-required destinations
# (Linux iptables sketch, adapt to your environment)
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -d <sap-backend-ip>/32 -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -P OUTPUT DROP