CVE-2026-89108 · CVSS 3.0 9.1 · SAP Note 3798788
An MII administrator is not necessarily meant to administer the Java server beneath it. SAP Note 3798788 closes a Configuration Service authorization gap that could let an authenticated MII administrator create an account with elevated Java-server privileges. SAP rates the issue HotNews, CVSS 9.1.
The boundary being crossed
Exploitation requires SAP XMII administrator privileges and network access to the affected endpoints. It is therefore an authenticated administrative attack, with no separate victim interaction. The escalation can reach control of the underlying Java application server, which explains the changed-scope vector and high confidentiality, integrity and availability impacts.
Patches for XMII 15.4 and 15.5
SAP describes the correction as preventing XMII administrators from using the Configuration Service to create accounts with SAP_J2EE_Engine_Admin. The note lists XMII 15.4 SP01 patch 59 and XMII 15.5 SP00 patch 49, SP01 patch 44 or SP02 patch 15. Use the patch corresponding to the installed branch. SAP also refers customers to FAQ 3833995.
Patch analysis: the Security import mode is disabled
We compared XMII 15.5 SP02 PL0 with SP02 PL15, the correction level listed for this branch in SAP Note 3798788. Two changes remove the old Configuration Service route to user and role provisioning.
First, ConfigServiceFactory no longer includes Security in its supported mode list. The Configuration handler uses that factory to resolve a requested mode. An unlisted mode produces no request processor, so the handler takes its existing INVALID_EXECMODE_ERROR path.
Second, Security.processRequest() loses its XML import implementation. Its new body consists of this error call:
ErrorHandler.handleError(this, "Mode not Supported", "Service");The handler therefore no longer performs the import even if code reaches it directly. In the inspected build, the concrete protection is removal of the dispatch route and disablement of the handler. There is no new role-validation branch in this method.
How the old path reached Java user management
The earlier handler parsed the supplied XML and passed it to UMEManager.createRolesFromXML() or UMEManager.createUserFromXML(). The latter creates a UME user and account, commits them, and assigns the roles specified in the document. This explains the boundary described in SAP’s advisory: an application administration function could reach user and role management on the underlying Java server.
The decompiled UMEManager source is unchanged between these two packages. The relevant change is in the Configuration Service entry path into that helper. SAP identifies creation of an account with SAP_J2EE_Engine_Admin as the escalation being prevented; our static comparison traces the provisioning path but does not independently demonstrate that account creation on a running system.
Scope of the diff and deployment checks
The newer factory also removes SysProps, ClientProps, DataServers, ServerPermissions and SystemPermissions from the dispatch list. These are observable differences across PL0 to PL15. Because that is a cumulative comparison, it does not establish that every removal was introduced specifically by this October security note.
For rollout, inventory custom administration tools that depend on these Configuration Service modes and test the supported workflows after patching. A removed mode can surface as an invalid-mode error. Confirm XMII 15.5 SP02 PL15 or the appropriate correction for another branch, then review privileged Java accounts against approved assignments. The code comparison does not show that patch installation removes accounts created before the update.
This analysis is based on the supplied archives, their component manifests and decompiled source. No exploit was run. The archive comparison covers the 15.5 SP02 branch; use SAP’s note for the correction levels on 15.4 and other 15.5 branches.
There is no SAP workaround
The advisory explicitly lists no workaround. Restricting administrative access and reviewing MII administrator assignments are reasonable interim controls, but they do not replace the patch. Where MII supports manufacturing operations, arrange deployment and application checks with the plant application owner.
Review privileged accounts as well as patch status
Confirm the deployed XMII component version after the maintenance window and test normal Configuration Service tasks with the intended roles. As a follow-up review, reconcile accounts carrying SAP_J2EE_Engine_Admin against approved administrators and investigate unexplained recent additions. This is a defensive review recommendation, not evidence that exploitation has occurred in your environment.
Advisory details
Component: MFG-MII
SAP priority: HotNews
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3798788 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
