CVE-2026-89108 · CVSS 3.0 9.1 · SAP Note 3798788
An MII administrator is not necessarily meant to administer the Java server beneath it. SAP Note 3798788 closes a Configuration Service authorization gap that could let an authenticated MII administrator create an account with elevated Java-server privileges. SAP rates the issue HotNews, CVSS 9.1.
The boundary being crossed
Exploitation requires SAP XMII administrator privileges and network access to the affected endpoints. It is therefore an authenticated administrative attack, with no separate victim interaction. The escalation can reach control of the underlying Java application server, which explains the changed-scope vector and high confidentiality, integrity and availability impacts.
Patches for XMII 15.4 and 15.5
SAP strengthens the Configuration Service checks so that an XMII administrator cannot use these functions to create accounts with SAP_J2EE_Engine_Admin. The note lists XMII 15.4 SP01 patch 59 and XMII 15.5 SP00 patch 49, SP01 patch 44 or SP02 patch 15. Use the patch corresponding to the installed branch. SAP also refers customers to FAQ 3833995.
There is no SAP workaround
The advisory explicitly lists no workaround. Restricting administrative access and reviewing MII administrator assignments are reasonable interim controls, but they do not replace the patch. Where MII supports manufacturing operations, arrange deployment and application checks with the plant application owner.
Review privileged accounts as well as patch status
Confirm the deployed XMII component version after the maintenance window and test normal Configuration Service tasks with the intended roles. As a follow-up review, reconcile accounts carrying SAP_J2EE_Engine_Admin against approved administrators and investigate unexplained recent additions. This is a defensive review recommendation, not evidence that exploitation has occurred in your environment.
Advisory details
Component: MFG-MII
SAP priority: HotNews
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3798788 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
