CVE-2026-44772 is a critical vulnerability in SAP Manufacturing Integration and Intelligence, commonly called SAP MII, a platform many organizations use to connect production operations with enterprise systems. SAP rated the issue 9.9 out of 10, reflecting the potential for a low-privileged authenticated user to execute commands on the server supporting a vulnerable SAP MII environment. For manufacturers, distributors, and enterprises whose operational workflows depend on MII data, integrations, and dashboards, this is a business continuity concern, not merely a software maintenance task.
You may be at risk if your organization operates affected SAP MII runtime or administration components, including versions in the 15.4 and 15.5 product lines. The immediate priority is to determine whether vulnerable systems are present, apply SAP’s remediation, and validate that its required protective configuration is actually enabled. This post explains the business exposure, common impact scenarios, practical steps to assess your environment, and technical validation guidance for security and SAP teams.
SAP disclosed CVE-2026-44772 on August 11, 2026, as part of its August Security Patch Day. The issue affects SAP Manufacturing Integration and Intelligence, specifically listed as XMII and MII_ADMIN 15.4 and 15.5. It was assigned a critical Common Vulnerability Scoring System score of 9.9 out of 10 under SAP Security Note 3765948.
In plain language, the vulnerability can let a user with limited access submit manipulated information that causes the SAP MII server to retrieve and process content from an attacker-controlled external location. That process can then be abused to run commands on the underlying server. This is categorized as code injection, with a related server-side request forgery condition, meaning the application can be tricked into making network requests from inside your environment.
SAP released a patch that adds a host allow-list control for transform-related requests. Critically, available technical analysis indicates that the associated Secure Transformer setting is disabled by default, so installing the update alone may not fully reduce exposure until the setting is enabled and configured with approved hosts.
If exploited, CVE-2026-44772 could give an attacker a pathway from a low-privileged SAP MII account to control over the server that supports critical manufacturing integration processes. That can disrupt the flow of information among plant-floor systems, production planning, quality processes, inventory operations, and enterprise resource planning applications. The practical result may be delayed orders, unavailable operational dashboards, incorrect production data, or forced shutdowns while your teams investigate and recover.
Your exposure is not limited to downtime. An attacker who gains command execution may be able to access sensitive operational data, credentials, system configuration, or connected internal services. Because SAP MII often sits between manufacturing technology and core business systems, a compromise can create a route into systems that were not initially exposed to the vulnerable application.
You also face reputational and compliance consequences. Disrupted manufacturing, incorrect reporting, or unauthorized access to sensitive data can affect customer commitments, supplier relationships, audit readiness, contractual obligations, and regulated-data protections. For U.S. and Canadian organizations, leadership should treat this as an enterprise risk requiring coordination between SAP owners, information technology, operational technology, security, legal, and business continuity teams. A patch must be paired with configuration validation, access review, and evidence-based monitoring.
A regional manufacturer: A regional manufacturer uses SAP MII to consolidate production-line data and feed dashboards used by plant supervisors. An attacker with a basic account abuses the vulnerability, gaining control of the MII host and interrupting data exchanges between production equipment and planning systems.
The company may continue producing goods temporarily, but leadership loses confidence in production status, quality measurements, and material consumption data. Recovery can require system isolation, incident response, manual reconciliation, and delayed shipments.
A North American food processor: A food processor depends on SAP MII for traceability, batch information, and production reporting across multiple facilities. A compromised MII server could affect the integrity or availability of operational records used to support quality and recall decisions.
Even where no food-safety issue occurs, the organization may need to prove which data was affected, rebuild trusted records, and notify customers or regulators as appropriate. The cost is often driven by operational uncertainty and investigation time, not only technical repair.
A mid-market industrial distributor: A distributor integrates warehouse and manufacturing data through SAP-connected workflows. An attacker who reaches the vulnerable server may disrupt data flows that support inventory visibility, fulfillment prioritization, and customer delivery commitments.
Your teams could face duplicate orders, inaccurate stock availability, or manual workarounds during containment. Customers may experience missed delivery dates even if customer-facing systems were not directly compromised.
A large energy or utilities operator: An enterprise uses SAP MII in operational reporting environments that are carefully segmented from business networks. The vulnerability’s ability to make server-side requests means a compromised MII application could be used to probe or reach internal services that are not publicly accessible.
This raises the stakes beyond one application. Security teams may need to investigate potential movement between network zones, review outbound connections, and verify that segmentation controls limited the blast radius.
/XMII/IllumXSLTServlet path.CVE-2026-44772 is an opportunity to test whether your SAP security controls work as designed under realistic conditions. IntegSec helps organizations identify exploitable weaknesses across enterprise applications, identity controls, internal networks, and operationally important environments. Our penetration testing services provide actionable findings, clear business context, and prioritized remediation guidance that supports measurable risk reduction. Contact IntegSec to schedule a penetration test and strengthen your defenses before a vulnerable pathway becomes an operational incident.
CVE-2026-44772 affects SAP MII’s Illuminator query processing path. The vulnerable implementation accepts the InlineTransform, CalculationTransform, and StyleSheet request parameters as locations from which the server retrieves XSL stylesheets. Before remediation, destination validation did not adequately restrict hostnames, protocols, loopback addresses, internal endpoints, or attacker-controlled external locations. The server then fetched and compiled the retrieved content as an XSLT stylesheet, creating both server-side request forgery and code-injection consequences.
The published CVSS v3.0 vector is CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This represents network reachability, low attack complexity, low required privileges, no user interaction, scope change, and high impact to confidentiality, integrity, and availability. The relevant weakness classifications are CWE-918, server-side request forgery, and CWE-94, code injection. SAP Security Note 3765948 is the authoritative vendor remediation reference; public NVD coverage should be monitored for the CVE record and any subsequent enrichment.
Component and patch validation: In NetWeaver Administrator or the MII system information interface, administrators should enumerate the installed XMII and MII_ADMIN component versions. Public component analysis identifies XMII 15.5 SP2 patch 13 or later and MII_ADMIN 15.5 SP2 patch 6 or later as patched examples, but SAP Security Note 3765948 should determine the exact required level for each deployed release.
Configuration verification: Administrators should confirm the presence of the Transformer Settings interface and verify that Secure Transformer is enabled. The Allowed List should contain only legitimate bare hostnames needed to serve external XSL resources. An unset Secure Transformer property defaults to false according to the analyzed implementation.
Log indicators: Defenders should search SAP MII application logs for sURL: records, Unable to read XSL document, Unable to resolve, and Final transformer is. Suspicious indicators include requests to loopback, link-local, cloud metadata, internal management, or unrecognized external addresses.
Network indicators: Proxy, reverse-proxy, ICM, firewall, and endpoint telemetry should be reviewed for outbound HTTP or HTTPS connections from SAP MII application servers to destinations not on an approved content-host list. Access logs should also be examined for /XMII/Illuminator requests containing InlineTransform, CalculationTransform, or StyleSheet, and for any access to /XMII/IllumXSLTServlet.
IllumXSLTServlet endpoint is not accessible after remediation, as the patched deployment removes its active mapping.redrays