CVE-2026-44765: SAP MII Auth Bypass Vulnerability

CVE-2026-44765 Overview

CVE-2026-44765 is a Missing Authorization Check vulnerability [CWE-862] in SAP Manufacturing Integration and Intelligence (SAP MII). An unauthenticated remote attacker can access scheduling-related application functions without proper authorization validation. Successful exploitation allows an attacker to retrieve, create, modify, or delete application-managed scheduling data. The flaw affects the confidentiality, integrity, and availability of scheduling data managed by the application.

The vulnerability requires no authentication, no user interaction, and can be triggered over the network. SAP addressed the issue in the August 2026 SAP Security Patch Day release.

Critical Impact
Unauthenticated network attackers can read and manipulate scheduling data in SAP MII, disrupting manufacturing operations that depend on the integrity of production scheduling records.

Affected Products

SAP Manufacturing Integration and Intelligence (SAP MII)
Scheduling-related application functions within SAP MII
Deployments exposed to network-reachable attackers without compensating controls

Discovery Timeline

2026-08-11 - CVE-2026-44765 published to NVD
2026-08-11 - Last updated in NVD database
August 2026 - SAP publishes fix via SAP Note #3758657 on SAP Security Patch Day

Technical Details for CVE-2026-44765

Vulnerability Analysis

SAP MII integrates shop-floor systems with enterprise applications and manages production scheduling data. The affected component exposes scheduling-related application functions over the network. These functions do not enforce an authorization check before processing requests.

An attacker sends crafted HTTP requests directly to the vulnerable scheduling endpoints. The application processes the requests without validating the caller's identity or entitlements. This allows read and write access to scheduling records held by the application.

Because the impacted functions cover create, read, update, and delete operations, an attacker can enumerate schedules, inject false entries, or remove existing ones. In manufacturing environments, tampering with schedule data can disrupt production sequencing and downstream MES workflows.

Root Cause

The root cause is a missing authorization check [CWE-862] on scheduling-related application functions in SAP MII. The application relies on request handlers that do not verify whether the caller holds the required role or entitlement before performing scheduling operations. This category of flaw is a design-level access control failure rather than an input validation or memory safety defect.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker who can reach the SAP MII HTTP interface can issue requests to the scheduling endpoints directly. No prior foothold, credential theft, or social engineering is required. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. Refer to SAP Note #3758657 for authoritative technical details on the affected endpoints and fix.

Detection Methods for CVE-2026-44765

Indicators of Compromise

Unauthenticated HTTP requests to SAP MII scheduling-related URLs originating from unexpected internal or external hosts
Unexplained creation, modification, or deletion of scheduling records in SAP MII application logs
Access to scheduling endpoints from IP addresses that do not correspond to known MII users or integration systems
Anomalous spikes in scheduling API traffic outside of normal production planning windows

Detection Strategies

Enable SAP MII application-level auditing for scheduling function calls and correlate with authenticated user sessions
Inspect web server and reverse proxy logs for scheduling endpoint access without a valid session cookie or authorization header
Baseline normal scheduling data change rates and alert on deviations, particularly outside business hours
Correlate SAP MII logs with network telemetry to identify direct endpoint access bypassing standard MII user interface flows

Monitoring Recommendations

Forward SAP MII application, HTTP, and audit logs to a centralized SIEM for correlation and retention
Monitor for HTTP 200 responses on scheduling endpoints where no prior authentication event exists in the same session
Track scheduling record CRUD operations by user identity and alert on operations attributed to anonymous or system accounts
Review network segmentation to confirm SAP MII scheduling interfaces are not reachable from untrusted networks

How to Mitigate CVE-2026-44765

Immediate Actions Required

Apply the fix described in SAP Note #3758657 to all affected SAP MII instances
Inventory all SAP MII deployments and confirm patch level against the August 2026 Security Patch Day baseline
Restrict network access to SAP MII HTTP interfaces to trusted management and integration segments only
Review scheduling data for unauthorized changes since the vulnerability's publication date

Patch Information

SAP released the fix on SAP Security Patch Day. Administrators should download and apply SAP Note #3758657 following standard SAP change management procedures. Additional context is available on the SAP Security Patch Day portal. Verify the corrected component version after installation and confirm that scheduling endpoints reject unauthenticated requests.

Workarounds

Place SAP MII behind a reverse proxy or web application firewall that enforces authentication before requests reach scheduling endpoints
Apply network access control lists to permit only trusted MES, ERP, and administrator hosts to reach SAP MII
Disable or block scheduling-related functions in SAP MII if they are not required for current operations, pending patch deployment
Increase logging verbosity on SAP MII to capture all requests to scheduling endpoints until the patch is applied

bash

# Example: restrict SAP MII scheduling endpoints at the reverse proxy
# (adapt paths and hostnames to your environment; consult SAP Note #3758657)
location /XMII/Scheduling/ {
    allow 10.10.20.0/24;   # MES integration subnet
    allow 10.10.30.0/24;   # SAP admin subnet
    deny  all;
    auth_request /_auth;   # enforce authentication before proxying
    proxy_pass https://sap-mii-backend;
}