CVE-2026-44764: SAP MII Auth Bypass Vulnerability

CVE-2026-44764 Overview

CVE-2026-44764 is a Missing Authorization Check vulnerability [CWE-862] in SAP Manufacturing Integration and Intelligence (MII). The flaw resides in the Cost Servlet component, which fails to verify caller authorization for specific parameter values. An unauthenticated remote attacker can send crafted HTTP requests to reach backend operations that should require valid credentials. Successful exploitation lets the attacker read, create, modify, or delete application-managed business data. SAP addressed the issue in an advisory published on SAP Security Patch Day and tracked in SAP Note #3758910.

Critical Impact
An unauthenticated network attacker can invoke backend Cost Servlet operations and tamper with SAP MII business data, affecting confidentiality, integrity, and availability of manufacturing process data.

Affected Products

SAP Manufacturing Integration and Intelligence (SAP MII)
Cost Servlet component within SAP MII
Refer to SAP Note #3758910 for the exact supported release and Support Package levels

Discovery Timeline

2026-08-11 - CVE-2026-44764 published to NVD
2026-08-11 - Last updated in NVD database
SAP Security Patch Day - SAP releases fix in SAP Note #3758910

Technical Details for CVE-2026-44764

Vulnerability Analysis

SAP MII exposes web-accessible servlets that mediate access to manufacturing data and backend business logic. The Cost Servlet processes requests tied to cost-related operations within the MII application layer. The servlet does not enforce an authorization check before executing selected backend actions when specific parameter values are supplied. As a result, requests originating from unauthenticated network clients can reach code paths that assume the caller has already been vetted.

The attack requires no user interaction, no privileges, and low complexity over the network. Because the impacted logic operates on application-managed business data, an attacker can perform data-plane operations rather than gain a shell. The impact is bounded to what the Cost Servlet code paths can reach, which explains the limited but non-trivial confidentiality, integrity, and availability effects.

Root Cause

The root cause is a missing authorization enforcement point in the Cost Servlet request handler. The servlet dispatches on specific parameter values without first validating that the requester holds the required role or permission. This is a classic [CWE-862] Missing Authorization defect, where authentication and authorization decisions are not applied uniformly across all reachable code branches.

Attack Vector

Exploitation is remote and network-based. An attacker sends crafted HTTP requests directly to the SAP MII Cost Servlet endpoint with parameter values that trigger the unprotected branches. The application processes these requests without an identity or role check and executes the requested backend operation. No authentication credentials, tokens, or prior session state are required. Refer to SAP Note #3758910 for the authoritative technical description.

Detection Methods for CVE-2026-44764

Indicators of Compromise

Unauthenticated HTTP requests to the SAP MII Cost Servlet URL path originating from external or unexpected internal sources
Requests to the Cost Servlet that carry parameter values associated with data create, modify, or delete operations without a preceding authenticated session
Unexpected modifications to MII-managed business data with no corresponding user identity in application audit logs

Detection Strategies

Enable and review SAP MII application access logs for Cost Servlet invocations that lack an authenticated principal
Correlate web server access logs with MII application logs to flag requests that produced data changes without a valid session
Baseline normal Cost Servlet traffic patterns, then alert on parameter combinations and source IPs that deviate from that baseline

Monitoring Recommendations

Forward SAP MII, NetWeaver, and web dispatcher logs to a centralized analytics platform such as Singularity Data Lake for retention and correlation
Monitor for anomalous outbound activity from MII hosts that could indicate follow-on data exfiltration after tampering
Use endpoint telemetry from Singularity Endpoint on the MII server tier to identify post-exploitation processes and file writes

How to Mitigate CVE-2026-44764

Immediate Actions Required

Apply the fix described in SAP Note #3758910 on all SAP MII instances
Inventory internet-exposed SAP MII endpoints and remove or restrict external reachability to the Cost Servlet
Review MII application and web access logs for prior invocations of the Cost Servlet from unauthenticated sources

Patch Information

SAP published the corrective note as part of SAP Security Patch Day. The authoritative fix and applicable Support Package levels are documented in SAP Note #3758910. Additional context is available on the SAP Security Patch Day portal. Administrators should apply the note through the standard SAP patch process and validate MII functionality after deployment.

Workarounds

Restrict network access to the SAP MII Cost Servlet using a reverse proxy or web dispatcher access control list until the patch is applied
Place SAP MII behind an authenticated gateway that enforces identity before requests reach the servlet
Block external access to MII administrative and servlet paths at the perimeter firewall
Audit and remove any legacy allow-list rules that expose MII servlets to untrusted networks

bash

# Example web dispatcher access control snippet to restrict Cost Servlet reachability
# Place in the SAP Web Dispatcher icm/HTTP/mod_0 permission table until SAP Note #3758910 is applied
if %{PATH} stricmp /XMII/Cost/* [OR]
if %{PATH} regimatch ^/XMII/.*Cost.*Servlet
  RegIRedirectUrl ^(.*)$ / [forbidden]