CVE-2026-58244

Executive Summary

CVE-2026-58244 is an authorization-bypass vulnerability in SAP Manufacturing Integration and Intelligence (MII). A low-privileged, authenticated attacker can invoke a specific application function that is missing a necessary server-side authorization check, allowing access to user account information that should be restricted to privileged users. The vulnerability has a CVSS base score of 4.3, a low confidentiality impact, and no integrity or availability impact. No patch, vendor advisory detail, or public exploit has been identified in the available intelligence data, meaning potentially affected SAP MII deployments should treat the exposure as currently unpatched.

Technical Analysis

SAP Manufacturing Integration and Intelligence (MII) is an SAP solution used to integrate manufacturing operations with enterprise business processes. It provides web-based application functions for monitoring, analytics, and integration scenarios. The NVD description for CVE-2026-58244 states that the product "does not perform necessary authorization check on certain application function." This is a classic CWE-862 — Missing Authorization condition.

The vulnerability class is an access-control flaw, not an injection or memory-corruption issue. Authentication is required, as indicated by PR:L in the CVSS vector. The attacker is already a valid user with low privileges in the SAP MII application, but the application does not verify that this user is entitled to call the affected function. As a result, the function returns data that should be visible only to privileged users — specifically, user account information.

Because the NVD description does not disclose the exact function name, URL endpoint, or affected SAP MII version, the precise code path cannot be reconstructed from this intelligence data. The attack mechanism is therefore characterized at the vulnerability-class level:

• A missing authorization check occurs when the application processes a legitimate application-function request.
• The server-side code fails to compare the requesting user’s role or permission set against the authorization required for the function.
• The function executes and returns restricted user account data to the requesting low-privileged account.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates that the vulnerable function is reachable over the network, exploitation is not technically complex, no user interaction is required, and the confidentiality impact is low. The lack of integrity or availability impact suggests the flaw is limited to information disclosure.

The attack surface is the authenticated network interface of SAP MII. In typical manufacturing deployment environments, SAP MII is exposed to internal enterprise networks and may also be reachable through web access management or remote access infrastructure. Because the affected version range is unknown, all SAP MII installations should be considered potentially exposed until SAP publishes patched version details.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-58244. The following attack chain is inferred from the vulnerability class and the NVD description.

Step 1: Target Identification and Reconnaissance

The attacker first identifies SAP MII instances. This can be performed through Shodan/Censys searches, internal network discovery, or by observing SAP MII login pages and application banners. Likely search terms include “SAP MII,” “Manufacturing Integration and Intelligence,” and related MII web-application titles. The attacker then enumerates valid low-privileged user accounts or obtains credentials through phishing, password spraying, or credential reuse.

Step 2: Authentication and Function Discovery

The attacker signs in to the SAP MII application with a low-privileged account. The attacker then identifies application functions that retrieve or expose user account information. Because the exact vulnerable function is not disclosed, the discovery process would involve manually navigating the application, reviewing application resource mappings, or analyzing client-side JavaScript. The attacker can then directly invoke the vulnerable function through the application’s normal request mechanism.

Step 3: Triggering the Missing Authorization Check

The attacker sends a request to the vulnerable application function. The server performs authentication (the user is logged in) but does not perform the required authorization check. The request is therefore processed even though the requesting user lacks the privileges normally required for that function. The “payload” is not an injection string; it is a crafted, legitimate application request that identifies the user account data the attacker wants to view. The server returns the restricted data in the HTTP response because the authorization logic is absent on this function.

Step 4: Post-Exploitation Impact

The attacker obtains user account information for privileged application users. The NVD description states that this information “could be leveraged to facilitate further attacks against the identified user accounts.” This can include credential phishing, password spraying, account enumeration, or attempts to abuse reused credentials across connected SAP systems. The disclosure itself has low confidentiality impact and does not directly modify data or interrupt service, but the stolen account data materially increases the attacker’s ability to pursue deeper access.

Impact Assessment

CVE-2026-58244 affects SAP MII installations where the vulnerable application function is exposed to authenticated low-privileged users. The business impact is primarily a confidentiality breach involving user account data. In an ERP-connected manufacturing environment, the exposed data may include usernames, display names, account identifiers, or role membership. If the application stores additional sensitive account attributes, those could also be exposed.

The CVSS base score of 4.3 is considered medium severity. The sub-factors in the vector are:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The blast radius is limited in direct technical impact but potentially broader in a strategic access-control chain. Account data harvested from SAP MII can be used to target SAP users, especially administrative accounts. In a converged IT/OT manufacturing environment, a compromise of privileged user accounts may lead to broader exposure of manufacturing execution data, order information, or integration credentials. There is no evidence of exploitation in the wild, and the EPSS score of 0.00168 places this CVE in a low percentile for predicted exploitation.

Detection Guidance

The following detection rules are heuristic and should be adapted to local SAP MII web logs, reverse-proxy logs, and application audit logs. Because the exact vulnerable endpoint is not disclosed and no public exploit signature exists, these rules focus on behavioral indicators: authenticated users with low privilege accessing account-related MII functions or receiving successful responses with user-account data.

Sigma Rule

title: CVE-2026-58244 SAP MII Missing Authorization User Account Access Attempt
id: 6b1f5a1c-0f54-4f7e-9f2a-7c0b8c2d9e11
status: experimental
description: Detects HTTP requests to SAP MII-related URIs that contain account-related keywords and return a successful response. Intended for reverse proxy or WAF logs in front of SAP MII. Because the vulnerable function is not disclosed, this rule is a generic heuristic.
logsource:
  category: web
  product: sap
  service: mii
detection:
  selection:
    http.response.status_code: 200
    url.query|contains|all:
      - 'mii'
      - 'account'
  condition: selection
fields:
  - client.address
  - user.name
  - url.original
  - http.response.status_code
falsepositives:
  - Legitimate SAP MII administrators accessing account management screens
  - Monitoring and health checks referencing account pages
level: medium

YARA Rule

rule sap_mii_missing_auth_cve_2026_58244 {
    meta:
        author = "Valters IT Threat Intelligence"
        cve = "CVE-2026-58244"
        description = "Detects text artifacts such as HTTP response captures, log extracts, or exported application data containing SAP MII identifiers and user account disclosure language."
    strings:
        $sap1 = "SAP MII" ascii wide nocase
        $sap2 = "Manufacturing Integration and Intelligence" ascii wide nocase
        $acct1 = "user account" ascii wide nocase
        $acct2 = "account information" ascii wide nocase
        $priv1 = "privileged" ascii wide nocase
    condition:
        any of ($sap*) and any of ($acct*) and $priv1
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET CVE-2026-58244 SAP MII Missing Authorization User Account Access Attempt"; flow:established,to_server; http.uri; content:"mii"; nocase; http.uri; content:"account"; nocase; reference:cve,2026-58244; sid:20008244; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ any where event.category == "web"
      and url.path like "*mii*"
      and url.path like "*account*"
      and http.response.status_code == 200 ]
  [ any where event.category == "web"
      and http.response.status_code == 200
      and http.response.body.content like "*user account*" ]

Splunk SPL Query

index=web sourcetype=access_combined status=200
| search uri="*mii*account*" OR uri="*account*mii*"
| stats count min(_time) max(_time) values(uri) by user src_ip
| where count > 5

Wazuh OSSEC Rule

<group name="sap_mii,">
  <rule id="408244" level="12">
    <decoded_as>web</decoded_as>
    <match>SAP MII</match>
    <regex>user account</regex>
    <description>Potential CVE-2026-58244 SAP MII missing authorization - user account information disclosure</description>
    <group>access_control,sap_mii,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence exists from any tracked source. The vendor has not published an official fix, affected version range, or workaround. Until SAP releases a security note and patched version, organizations must apply compensating controls.

1) Immediate Mitigations

• Restrict network access to SAP MII application functions to only trusted users and necessary business segments.
• Enforce least privilege for all SAP MII accounts. Review and remove unnecessary low-privileged accounts that can reach sensitive functions.
• Monitor authenticated access to user-account-related functions and flag successful responses to non-privileged accounts.
• Enable and preserve SAP MII application audit logs, reverse-proxy access logs, and WAF logs for forensic analysis.
• If the vulnerable function can be identified, disable it or restrict it with an external middle-tier authorization filter.

2) Patch and Upgrade Steps

• There is currently no patch available from SAP or any other tracked source.
• Subscribe to SAP Security Notes and monitor for a new security note referencing CVE-2026-58244.
• When SAP publishes a patched MII version, apply the update according to the SAP release and transport procedures.
• Validate the patch’s coverage by retesting the affected function with a low-privileged account.

3) Long-Term Hardening

• Integrate SAP MII authentication with enterprise single sign-on and centralized identity management to simplify account lifecycle controls.
• Conduct periodic authorization reviews for SAP MII roles and function permissions.
• Segment SAP MII from the broader corporate network and from OT/ICS networks unless integration requires direct access.
• Deploy a web application firewall with the ability to block sensitive function access based on the user-role mapping.
• Include SAP MII in vulnerability management and threat-hunting processes, prioritizing any new CVE-2026-58244 exploitation indicators.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-58244
• SAP Security Notes Portal: https://support.sap.com/en/my-support/knowledge-base/security-notes.html
• FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-58244
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns or exploit-in-the-wild evidence were identified. No researcher blog or vendor advisory beyond the NVD description was provided in the available intelligence data.