CVE-2026-44772: SAP Manufacturing Integration and Intelligence Code Injection Bug - What It Means for Your Business and How to Respond

Introduction

CVE-2026-44772 is a critical vulnerability in SAP Manufacturing Integration and Intelligence, commonly called SAP MII, a platform many organizations use to connect production operations with enterprise systems. SAP rated the issue 9.9 out of 10, reflecting the potential for a low-privileged authenticated user to execute commands on the server supporting a vulnerable SAP MII environment. For manufacturers, distributors, and enterprises whose operational workflows depend on MII data, integrations, and dashboards, this is a business continuity concern, not merely a software maintenance task.

You may be at risk if your organization operates affected SAP MII runtime or administration components, including versions in the 15.4 and 15.5 product lines. The immediate priority is to determine whether vulnerable systems are present, apply SAP’s remediation, and validate that its required protective configuration is actually enabled. This post explains the business exposure, common impact scenarios, practical steps to assess your environment, and technical validation guidance for security and SAP teams.

S1 — Background & History

SAP disclosed CVE-2026-44772 on August 11, 2026, as part of its August Security Patch Day. The issue affects SAP Manufacturing Integration and Intelligence, specifically listed as XMII and MII_ADMIN 15.4 and 15.5. It was assigned a critical Common Vulnerability Scoring System score of 9.9 out of 10 under SAP Security Note 3765948.

In plain language, the vulnerability can let a user with limited access submit manipulated information that causes the SAP MII server to retrieve and process content from an attacker-controlled external location. That process can then be abused to run commands on the underlying server. This is categorized as code injection, with a related server-side request forgery condition, meaning the application can be tricked into making network requests from inside your environment.

SAP released a patch that adds a host allow-list control for transform-related requests. Critically, available technical analysis indicates that the associated Secure Transformer setting is disabled by default, so installing the update alone may not fully reduce exposure until the setting is enabled and configured with approved hosts.

S2 — What This Means for Your Business

If exploited, CVE-2026-44772 could give an attacker a pathway from a low-privileged SAP MII account to control over the server that supports critical manufacturing integration processes. That can disrupt the flow of information among plant-floor systems, production planning, quality processes, inventory operations, and enterprise resource planning applications. The practical result may be delayed orders, unavailable operational dashboards, incorrect production data, or forced shutdowns while your teams investigate and recover.

Your exposure is not limited to downtime. An attacker who gains command execution may be able to access sensitive operational data, credentials, system configuration, or connected internal services. Because SAP MII often sits between manufacturing technology and core business systems, a compromise can create a route into systems that were not initially exposed to the vulnerable application.

You also face reputational and compliance consequences. Disrupted manufacturing, incorrect reporting, or unauthorized access to sensitive data can affect customer commitments, supplier relationships, audit readiness, contractual obligations, and regulated-data protections. For U.S. and Canadian organizations, leadership should treat this as an enterprise risk requiring coordination between SAP owners, information technology, operational technology, security, legal, and business continuity teams. A patch must be paired with configuration validation, access review, and evidence-based monitoring.

S3 — Real-World Examples

A regional manufacturer: A regional manufacturer uses SAP MII to consolidate production-line data and feed dashboards used by plant supervisors. An attacker with a basic account abuses the vulnerability, gaining control of the MII host and interrupting data exchanges between production equipment and planning systems.

The company may continue producing goods temporarily, but leadership loses confidence in production status, quality measurements, and material consumption data. Recovery can require system isolation, incident response, manual reconciliation, and delayed shipments.

A North American food processor: A food processor depends on SAP MII for traceability, batch information, and production reporting across multiple facilities. A compromised MII server could affect the integrity or availability of operational records used to support quality and recall decisions.

Even where no food-safety issue occurs, the organization may need to prove which data was affected, rebuild trusted records, and notify customers or regulators as appropriate. The cost is often driven by operational uncertainty and investigation time, not only technical repair.

A mid-market industrial distributor: A distributor integrates warehouse and manufacturing data through SAP-connected workflows. An attacker who reaches the vulnerable server may disrupt data flows that support inventory visibility, fulfillment prioritization, and customer delivery commitments.

Your teams could face duplicate orders, inaccurate stock availability, or manual workarounds during containment. Customers may experience missed delivery dates even if customer-facing systems were not directly compromised.

A large energy or utilities operator: An enterprise uses SAP MII in operational reporting environments that are carefully segmented from business networks. The vulnerability’s ability to make server-side requests means a compromised MII application could be used to probe or reach internal services that are not publicly accessible.

This raises the stakes beyond one application. Security teams may need to investigate potential movement between network zones, review outbound connections, and verify that segmentation controls limited the blast radius.

S4 — Am I Affected?

• You are likely affected if you run SAP Manufacturing Integration and Intelligence components XMII 15.4 or 15.5, or MII_ADMIN 15.4 or 15.5.
• You should assume elevated risk if your SAP MII users have broad access to execute Illuminator queries or related reporting and transformation functions, even if those users do not hold administrator privileges.
• You need immediate review if SAP MII can reach external websites, internal web services, cloud metadata endpoints, management networks, or other sensitive destinations from its application server.
• You should verify remediation if you installed SAP Security Note 3765948 but have not explicitly enabled the Secure Transformer setting and populated its Allowed List with only necessary, approved host names. The setting is reported to default to disabled when not configured.
• You should investigate for possible prior exploitation if logs show unexpected outbound requests from the MII server, unfamiliar transform source addresses, or requests to the /XMII/IllumXSLTServlet path.

Key Takeaways

• CVE-2026-44772 is a critical SAP MII code injection vulnerability with a 9.9 severity score and potential for command execution on the affected server.
• Your risk is greatest when vulnerable SAP MII systems connect operational technology, production reporting, enterprise applications, and internal network services.
• A low-privileged user account may be sufficient for exploitation, so account access and authorization reviews matter alongside patching.
• Installing SAP’s update is essential, but you should also enable Secure Transformer and configure a restrictive allow-list of approved external stylesheet hosts.
• Your incident response process should include reviewing MII, proxy, and network logs for suspicious outbound requests and unexpected transformation activity.

Call to Action

CVE-2026-44772 is an opportunity to test whether your SAP security controls work as designed under realistic conditions. IntegSec helps organizations identify exploitable weaknesses across enterprise applications, identity controls, internal networks, and operationally important environments. Our penetration testing services provide actionable findings, clear business context, and prioritized remediation guidance that supports measurable risk reduction. Contact IntegSec to schedule a penetration test and strengthen your defenses before a vulnerable pathway becomes an operational incident.

TECHNICAL APPENDIX

A — Technical Analysis

CVE-2026-44772 affects SAP MII’s Illuminator query processing path. The vulnerable implementation accepts the InlineTransform, CalculationTransform, and StyleSheet request parameters as locations from which the server retrieves XSL stylesheets. Before remediation, destination validation did not adequately restrict hostnames, protocols, loopback addresses, internal endpoints, or attacker-controlled external locations. The server then fetched and compiled the retrieved content as an XSLT stylesheet, creating both server-side request forgery and code-injection consequences.

The published CVSS v3.0 vector is CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This represents network reachability, low attack complexity, low required privileges, no user interaction, scope change, and high impact to confidentiality, integrity, and availability. The relevant weakness classifications are CWE-918, server-side request forgery, and CWE-94, code injection. SAP Security Note 3765948 is the authoritative vendor remediation reference; public NVD coverage should be monitored for the CVE record and any subsequent enrichment.

B — Detection & Verification

Component and patch validation: In NetWeaver Administrator or the MII system information interface, administrators should enumerate the installed XMII and MII_ADMIN component versions. Public component analysis identifies XMII 15.5 SP2 patch 13 or later and MII_ADMIN 15.5 SP2 patch 6 or later as patched examples, but SAP Security Note 3765948 should determine the exact required level for each deployed release.

Configuration verification: Administrators should confirm the presence of the Transformer Settings interface and verify that Secure Transformer is enabled. The Allowed List should contain only legitimate bare hostnames needed to serve external XSL resources. An unset Secure Transformer property defaults to false according to the analyzed implementation.

Log indicators: Defenders should search SAP MII application logs for sURL: records, Unable to read XSL document, Unable to resolve, and Final transformer is. Suspicious indicators include requests to loopback, link-local, cloud metadata, internal management, or unrecognized external addresses.

Network indicators: Proxy, reverse-proxy, ICM, firewall, and endpoint telemetry should be reviewed for outbound HTTP or HTTPS connections from SAP MII application servers to destinations not on an approved content-host list. Access logs should also be examined for /XMII/Illuminator requests containing InlineTransform, CalculationTransform, or StyleSheet, and for any access to /XMII/IllumXSLTServlet.

C — Mitigation & Remediation

1. Immediate (0–24h): Identify every SAP MII environment, including production, disaster recovery, quality assurance, and development systems. Prioritize internet-accessible instances and instances that can reach sensitive internal networks. Apply SAP Security Note 3765948 and the corresponding product updates according to SAP’s official support guidance. SAP and public government guidance recommend immediate patching of affected systems.
2. Immediate (0–24h): After deployment, explicitly enable Secure Transformer and configure the Allowed List with the minimum necessary bare hostnames. Do not rely on the presence of a patch alone. If you cannot patch immediately, restrict outbound network connectivity from SAP MII servers to only necessary destinations, block access to cloud metadata and management networks, and limit access to MII query and transformation features to essential users.
3. Short-term (1–7d): Review SAP MII roles, query-execution rights, service accounts, and privileged administrative access. Remove dormant accounts, enforce multi-factor authentication where supported, and investigate unexpected external transform sources or outbound requests. Confirm that the IllumXSLTServlet endpoint is not accessible after remediation, as the patched deployment removes its active mapping.redrays
4. Short-term (1–7d): Test approved MII templates and integrations after the allow-list change. Legitimate external stylesheet requests should work only when their host is explicitly approved. Failed requests to unapproved locations should be treated as a validation signal, then assessed to determine whether they indicate legacy configuration or suspicious activity.
5. Long-term (ongoing): Segment SAP MII application servers from sensitive operational, management, and identity infrastructure. Maintain egress filtering, centralize application and network logs, run periodic authenticated vulnerability assessments, and conduct penetration testing that evaluates SAP authorization boundaries, server-side request behavior, and lateral-movement controls.

D — Best Practices

• Restrict SAP MII server outbound connectivity to defined business destinations rather than allowing unrestricted internet and internal-network access.
• Maintain a strict, documented allow-list for all externally hosted transformation resources and remove hosts that no longer support active integrations.
• Limit query-execution and transformation permissions to users and service accounts with a documented operational need.
• Monitor SAP MII application logs and network telemetry for unexpected URL fetches, especially requests toward internal, loopback, link-local, or cloud metadata addresses.
• Validate vulnerability remediation through configuration checks and controlled security testing, not solely through patch-management records