Inside the SAP MII Vulnerability Cluster: August 2026 Patch Day

SAP released 28 new Security Notes on August 11, 2026. While monthly vulnerability reporting typically centers on headline CVSS scores, the primary narrative this month is a specific product cluster. Six of the released notes impact a single component: SAP Manufacturing Integration and Intelligence (MII). Onapsis Research Labs uncovered all six vulnerabilities during a single, sustained research effort.

The set includes two critical vulnerabilities (CVSS 9.9 and 9.1), three high-priority flaws, and one medium-priority issue. Examined individually, each note represents a manageable patch. Examined together, the findings describe a systemic architectural weakness in how the platform handled caller-supplied transformation logic, file paths, and authorization boundaries.

Why SAP MII is a High-Value Cyber Target

SAP MII does not function as a peripheral reporting utility. The application serves as the primary translation layer between operational technology (OT) plant floor assets and enterprise resource planning (ERP) business logic. SAP MII translates emissions from machinery, historians, and line controllers into ERP-actionable records while pushing production orders and specifications down to plant networks.

This dual reachability makes the platform uniquely vulnerable. Command execution on an SAP MII host places an attacker at the exact architectural intersection trusted by both OT and IT networks. Exploitation in a manufacturing environment threatens business data, production process integrity, batch records, and safety-relevant operational instructions.

The Transformation Engine: Two Critical Code Injection Findings

Both critical findings trace back to how SAP MII handled XSL transformations. Turning one industrial data representation into another is a core requirement of the application. However, trust placement flaws in the transformation engine created severe remote code execution risks.

• CVE-2026-44772 (CVSS 9.9, SAP Note 3765948): Addresses a critical code injection vulnerability in the XSL transform path. The issue stems from trust placement: inputs that should have been treated as inert data could steer the platform into retrieving and processing external content specified by the caller. Once an application fetches and executes logic supplied from outside its trust boundary, the distinction between processing a document and running a program collapses. SAP Note 3765948 requires mandatory post-patch configuration. Administrators must manually activate the Secure Transformer control and populate the Allowed Hosts allowlist. A patched system without this post-patch configuration reports as compliant but remains fully exposed.
• CVE-2026-44758 (CVSS 9.1, SAP Note 3758900): Impacts IllumXSLTServlet, an endpoint that compiled stylesheets supplied directly by the caller. Compiling caller-supplied logic is, functionally, an invitation to execute caller-supplied code. Rather than hardening the endpoint, SAP removed IllumXSLTServlet entirely. This fix carries a functional footprint: integrations that quietly depended on that servlet will stop working rather than fail loudly. 

Neither vulnerability requires administrative privileges. Both flaws are reachable by low-privileged authenticated users. In OT-adjacent environments, service accounts are numerous, long-lived, widely shared across integrations, and frequently documented in runbooks. Low privilege requirements combined with arbitrary code execution on a cross-network bridging component drove these critical CVSS scores.

Path Traversal and Authorization Flaws

The remaining four notes in the cluster address missing authorization checks and file handling gaps that allow attackers to consolidate a foothold or perform internal reconnaissance:

• CVE-2026-44763 (CVSS 7.6, SAP Note 3759854): Covers a path traversal vulnerability in the SSCE interface. File save operations lacked proper directory confinement, enabling arbitrary file writes outside intended directories. Arbitrary file writes typically serve as the intermediate step in multi-stage exploit chains.
• CVE-2026-44765 (CVSS 7.3, SAP Note 3758657): Resolves a missing authorization check on scheduling functions. Unauthorized callers could retrieve, create, modify, or delete application scheduling data, granting the ability to execute tasks repeatedly under platform identity. The fix introduces new role assignments, requiring a deliberate role design review rather than a routine import.
• CVE-2026-44764 (CVSS 7.3, SAP Note 3758910): Resolves a missing authorization check in Cost Servlet operations where crafted parameter values enabled unauthorized backend operations to read, create, modify, or delete business data. Remediated via Support Package.
• CVE-2026-58244 (CVSS 4.3, SAP Note 3781137): Enforces authorization checks on user account functions. Low-privileged authenticated attackers could access restricted user information, providing the intelligence needed for reconnaissance.

The Underlying Pattern: A Single Design Assumption

Analyzing the six notes as an integrated set reveals an underlying design pattern. SAP MII repeatedly accepted caller-supplied instructions (stylesheets, file paths, scheduled actions, and privileged operations) without consistently verifying caller authorization or validating inputs.

Applying the six security notes resolves specific bug instances. However, durable risk reduction requires re-evaluating network exposure to verify which identities and network segments can reach SAP MII endpoints.

This cluster challenges a common cybersecurity bias: the instinct to discount vulnerabilities that require authentication. In an OT-adjacent context, this instinct is dangerous. Because service accounts are widely shared, long-lived, and documented in runbooks, “requires low privilege” effectively describes a massive population on a plant network. Authenticated code execution on a bridging component must be treated as a first-class finding. 

Actionable Remediation Plan

Security teams managing SAP MII should execute the following remediation steps:

1. Apply All Six Security Notes: Deploy SAP Notes 3765948, 3758900, 3759854, 3758657, 3758910, and 3781137. Fixing authorization gaps prevents attackers from leveraging initial access.
2. Execute Post-Patch Configuration: Enable the Secure Transformer property and populate the Allowed Hosts field as required by Note 3765948.
3. Audit Dependent Integrations: Identify all internal and third-party integrations calling IllumXSLTServlet before applying Note 3758900 to avoid unexpected operational outages.
4. Implement Least-Privilege Role Design: Evaluate the new role assignments created by Note 3758657 carefully, avoiding broad role assignments that reproduce security exposure.
5. Restrict Endpoint Reachability: Audit network segmentation to confirm only authorized OT and IT systems can reach SAP MII interfaces.

Verification: Onapsis customers can utilize Onapsis Assess to scan the environment, confirm the successful deployment of all patches, and validate the required manual configuration changes.

Credit: All six SAP MII vulnerabilities were discovered and responsibly disclosed to SAP by Onapsis Research Labs. The research effort was led by Adrian Radulescu.