CVE-2026-58244: SAP MII Auth Bypass Vulnerability

CVE-2026-58244 Overview

CVE-2026-58244 is a missing authorization vulnerability in SAP Manufacturing Integration and Intelligence (MII). The affected application function does not perform the required authorization check, allowing a low-privileged authenticated attacker to access user account information that should be restricted to privileged users. The flaw maps to CWE-862: Missing Authorization. Successful exploitation exposes account details that attackers can use to facilitate follow-on attacks against the identified user accounts. The issue affects confidentiality only, with no impact on integrity or availability.

Critical Impact
A low-privileged authenticated user can retrieve restricted account information over the network, providing reconnaissance data for targeted follow-on attacks against SAP MII users.

Affected Products

SAP Manufacturing Integration and Intelligence (MII)
Refer to SAP Note #3781137 for the authoritative list of affected versions
Consult SAP Security Patch Day for the corresponding patch release

Discovery Timeline

2026-08-11 - CVE-2026-58244 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-58244

Vulnerability Analysis

SAP MII is a manufacturing intelligence platform that connects shop-floor systems with enterprise applications. The vulnerable component exposes an application function that returns user account information. The function omits the authorization check normally required to gate access to that data.

A network-reachable attacker who holds any valid low-privileged application account can call the function and retrieve information about other users. The returned data is intended for administrators or otherwise privileged roles. Because the flaw is a broken access-control condition, no memory corruption, injection, or credential compromise is required to exploit it.

The attacker outcome is targeted reconnaissance. Enumerated account attributes enable password spraying, phishing against specific identities, or lateral movement planning inside SAP landscapes. The vulnerability does not permit modification of records or disruption of service.

Root Cause

The root cause is a missing authorization check [CWE-862] in an SAP MII application function. The handler processes requests from any authenticated principal without validating that the caller holds the role required to view the returned account information.

Attack Vector

Exploitation requires network access to the SAP MII interface and a low-privileged authenticated session. No user interaction is required. The attacker sends a request to the affected function endpoint and receives account information that the authorization model should have blocked. See SAP Note #3781137 for the technical description of the vulnerable function.

Detection Methods for CVE-2026-58244

Indicators of Compromise

Requests to the affected SAP MII application function originating from user accounts that do not hold administrative or user-management roles
Unusual enumeration patterns against SAP MII endpoints, such as sequential or bulk queries for user records within a short window
Authenticated sessions from low-privileged users accessing account-information responses outside of normal job functions

Detection Strategies

Review SAP MII application and HTTP access logs for calls to the vulnerable function by non-privileged roles, cross-referenced with the role mapping defined in SAP Note #3781137
Baseline normal API usage per role and alert on deviations where low-privileged accounts retrieve user account data
Correlate SAP audit log entries with identity provider logs to identify accounts performing reconnaissance across multiple systems

Monitoring Recommendations

Forward SAP MII audit and web dispatcher logs to a centralized SIEM for role-based access analytics
Enable SAP Security Audit Log events for read access to user administration functions
Track failed and successful authentication events for accounts that subsequently query the affected endpoint

How to Mitigate CVE-2026-58244

Immediate Actions Required

Apply the SAP MII patch referenced in SAP Note #3781137 during the next available maintenance window
Inventory SAP MII instances exposed to internal or external networks and prioritize patching for those reachable by broad user populations
Review role assignments in SAP MII and remove unnecessary access for low-privileged accounts
Rotate credentials for any accounts whose information may have been exposed if suspicious access is detected

Patch Information

SAP released the fix as part of SAP Security Patch Day. Download the corrective package from SAP Note #3781137 and follow the release notes on the SAP Security Patch Day portal. The patch restores the missing authorization check on the affected application function.

Workarounds

Restrict network access to SAP MII interfaces to trusted management networks using firewall rules or SAP Web Dispatcher access control lists
Tighten role assignments so that only accounts requiring MII access retain authentication capability to the platform
Increase logging verbosity on the affected function and monitor for unauthorized access until the patch is applied

bash

# Configuration example - restrict SAP MII access at the network edge
# Replace 10.10.0.0/16 with your trusted admin subnet
iptables -A INPUT -p tcp --dport 50000 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP