TL;DR: CVE-2026-44758 is a code injection vulnerability in SAP Manufacturing Integration and Intelligence (MII) that lets an attacker with high privileges execute arbitrary commands on the underlying operating system. The impact is high across confidentiality, integrity, and availability. SAP MII sits at the junction between IT systems and factory floor operations, so exploitation can compromise both enterprise data and manufacturing processes simultaneously.

The ecosystem at risk

SAP MII is not a general-purpose web application. It is the bridge between enterprise IT and operational technology on the manufacturing shop floor. MII pulls production data from SCADA systems, programmable logic controllers, and MES platforms, then feeds that data into SAP ERP for real-time visibility into manufacturing operations. Production managers use MII dashboards to monitor throughput, downtime, and quality metrics across factory lines.

The reason CVE-2026-44758 matters more than a typical code injection is this IT/OT convergence. A single compromised MII instance can expose both layers: the SAP ERP database containing financial and supply chain data, and the manufacturing control systems it connects to. An attacker who achieves OS-level command execution on the MII server can pivot laterally into plant floor equipment in a way that a standard ERP vulnerability would never allow.

This is also not the first time this component has been hit with a critical code injection. CVE-2021-21480, disclosed in March 2021, was a CVSS 9.9 vulnerability in SAP MII involving the Self-Service Composition Environment (SSCE). An attacker injected malicious JSP code into dashboard objects that got stored on the server and executed when opened by other users. The pattern is now repeating five years later under a new CVE ID [6][7][8].

How the attack works

The vulnerability description states that an attacker with high privileges submits specially crafted input to affected MII functionality. That input is processed without sufficient validation. The result: arbitrary command execution on the underlying operating system of the MII host.

The full impact triad is high confidentiality, high integrity, and high availability. That distinguishes this CVE from CVE-2026-58236 (the NetWeaver OS command injection patched in the same batch), which reported no confidentiality impact. Here, the attacker can read sensitive files, modify data on the server, and take the system offline. In a manufacturing context, taking MII offline can halt production monitoring and coordination across an entire plant.

The high-privilege requirement again narrows the initial attack surface, but in SAP environments, high-privilege accounts are frequently shared among implementation consultants, integration teams, and operations staff. A single compromised developer account on an MII system is all that stands between an attacker and OS-level control.

Who is affected

SAP Manufacturing Integration and Intelligence across versions where the affected functionality exists. The hol.org CVE record does not list specific fixed versions yet. SAP MII is deployed primarily by manufacturers in automotive, pharmaceuticals, consumer goods, heavy industry, and food and beverage sectors. These are companies that run SAP ERP for back-office operations and need real-time data exchange with shop floor systems.

SAP does not publish exact MII customer counts, but the broader SAP manufacturing footprint covers tens of thousands of plants worldwide. The Houlihan Lokey industry report notes over 440,000 SAP customers across all sectors, with manufacturing among the largest verticals [13]. Every one of those customers running MII as their IT/OT integration layer is exposed to this CVE.

What to do

SAP issued this advisory as part of August 2026 Security Patch Day. Immediate steps:

1. Log in to SAP Support Portal at support.sap.com and locate the security note associated with CVE-2026-44758 for SAP MII.
2. Apply the patch to all MII instances in your landscape. Prioritize production environments connected to live manufacturing systems.
3. Restrict the SAP_XMII Developer role and equivalent high-privilege roles to named individuals only. Remove broad role assignments left from implementation projects.
4. Review MII application logs and OS audit logs for signs of code injection: unexpected JSP or script files on the server, anomalous process execution, or unfamiliar dashboard objects.
5. Segment the MII server network from both the SAP ERP backend and the shop floor OT network. If the MII server is compromised, network segmentation prevents lateral movement into either direction.
6. If patching requires a maintenance window, coordinate with plant operations. Taking MII offline for patching can temporarily disrupt production monitoring, so plan the downtime accordingly.

Why it matters

The recurrence of code injection vulnerabilities in SAP MII is a systemic issue. CVE-2021-21480 was rated 9.9 CVSS and allowed remote code execution through the same SSCE dashboard mechanism [6][7][8]. That vulnerability was exploited conceptually the same way: craft input, submit it to MII, get code execution on the server. The fact that SAP patched that specific vector in 2021 and a new code injection CVE appears in 2026 suggests the component's validation architecture keeps producing injection paths.

For security teams, the takeaway is to treat SAP MII as a privileged attack surface regardless of the current patch level. The component sits at an IT/OT boundary, handles untrusted input from multiple integration points, and grants OS-level access when exploited. That combination makes it a persistent target.

The high confidentiality, integrity, and availability impact in the CVE description suggests NVD will assign a CVSS score in the critical range (9.0 or above) once the formal assessment is published. Organizations that wait for the NVD score before patching are leaving a known code injection path open on their manufacturing systems.

Context: what is SAP Manufacturing Integration and Intelligence?

SAP MII is the integration platform that connects SAP ERP with manufacturing execution systems and shop floor equipment. It aggregates data from SCADA systems, PLCs, sensors, and MES platforms, then presents it through configurable dashboards and reports. Plant managers use MII to see real-time production metrics like OEE (overall equipment effectiveness), line throughput, downtime causes, and quality defect rates.

The component also supports the Self-Service Composition Environment (SSCE), which allows authorized users to build dashboards through a drag-and-drop interface. Those dashboards are saved as server-side objects. The SSCE was the entry point for CVE-2021-21480 and remains a component to watch for injection vectors.

References

• CVE-2026-44758 on HOL Guard
• SAP Security Patch Day
• Onapsis advisory on prior SAP MII code injection (CVE-2021-21480)
• SecurityWeek: SAP patches critical flaws in MII, NetWeaver