TL;DR: SAP Manufacturing Integration and Intelligence (MII) fails to validate file paths in certain functions. A privileged attacker can craft input that writes files outside the intended directory, reaching a high impact across confidentiality, integrity, and availability. Apply the patch from SAP Note 3594149 and audit file write activity on your MII servers.

The attack chain

Path traversal attacks work by injecting directory-change sequences into a file path the application constructs without proper validation. The attacker supplies a filename or path parameter that includes sequences like ../ to move up the directory tree. If the application concatenates that input into a filesystem path without canonicalizing and checking the result, the write lands wherever the attacker points it.

CVE-2026-44763 affects SAP MII's file-handling functions. The advisory states that certain functions accept user input for file paths without sufficient validation. A privileged attacker crafts a request containing a traversal payload. The file gets written to a location outside the intended directory boundary.

There is a second stage. The advisory notes that successful exploitation also requires a legitimate user to subsequently access the attacker-influenced content. This is an injection-then-trigger pattern: the attacker plants the file, then waits for or social-engineers a legitimate user to open it. The conditions depend on factors outside the attacker's direct control, which raises the exploitation complexity but does not eliminate the threat.

The impact rating is high across confidentiality, integrity, and availability. A file planted in the right location can overwrite configuration, inject scripts, or replace executables that run on the next service restart.

Who is affected

Affected package: SAP Manufacturing Integration and Intelligence, namespace SAP_SE.

What SAP MII is: SAP MII is the integration layer that connects manufacturing shop-floor systems (PLCs, SCADA, MES) to SAP's enterprise applications. It sits between the plant floor and ERP, translating machine data into business context and pushing production orders back down to the line. Organizations in discrete manufacturing, process industries, and utilities deploy MII to synchronize real-time production data with inventory, quality, and maintenance workflows.

Install base: SAP does not publish precise MII license counts, but the product targets mid-to-large industrial customers running SAP ERP alongside plant-floor systems. Most deployments are on-premises, sitting inside the manufacturing network DMZ.

Exploitation prerequisites: The attacker needs privileged access to MII. The planted file must then be opened by a legitimate user. This two-stage requirement narrows the threat to attackers who already have a foothold inside the manufacturing environment and can influence user behavior.

What to do

1. Apply the SAP patch. Check SAP Note 3594149 for the specific support package and patch level covering CVE-2026-44763 for your MII version.
2. Audit file write paths. Review the MII server's filesystem for files written outside expected upload directories since the last patch cycle. Pay attention to scripts, JSP files, and configuration overwrites.
3. Restrict privileged MII accounts. Limit who can submit file-handling requests. Review role assignments in the MII administration console and remove file-upload permissions from accounts that do not need them.
4. Monitor for planted files. Set filesystem integrity monitoring (AIDE, Tripwire) on the MII install directory and web application deployment folders. Alert on any write outside the configured upload directory.

Why it matters

Manufacturing environments are increasingly targeted. A path traversal that lets an attacker plant files on the integration server between the plant floor and ERP is a direct route to production disruption. A planted script or overwritten config can corrupt data feeds, inject unauthorized production orders, or take the integration layer offline.

The two-stage exploitation requirement (plant then trigger) makes opportunistic remote attacks harder. It does not protect against an insider or an attacker who has already established persistence in the manufacturing network. Industrial environments often run long patch cycles, and MII servers are typically maintained by plant IT teams who prioritize uptime over security patching.

CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. No public exploit is available. The patch exists, and the exposure window depends on how quickly your manufacturing IT organization applies it.

References

• CVE-2026-44763 on NVD
• SAP Support Portal (search Note 3594149)
• This post on hol.org