CVE-2026-44763

Full vulnerability record from the local CVENow database.

Description

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.

Severity

HIGH

CVSS score

7.6 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-08-11 01:17:20.930000

Last modified

2026-10-23 19:10:00.167000

View original CVE JSON

{
  "id": "CVE-2026-44763",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-11T01:17:20.930",
  "lastModified": "2026-10-23T19:10:00.167",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability."
    },
    {
      "lang": "es",
      "value": "SAP Manufacturing Integration y Intelligence permite a un atacante privilegiado explotar una validación insuficiente de rutas de archivo en ciertas funciones utilizando una entrada especialmente diseñada. La explotación también requiere que un usuario legítimo acceda posteriormente al contenido influenciado por el atacante y depende de condiciones fuera del control del atacante. Una explotación exitosa podría permitir que se escriban archivos fuera del directorio previsto y afectar a otros componentes, lo que resultaría en un alto impacto en la confidencialidad, integridad y disponibilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP Manufacturing Integration and Intelligence",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "XMII 15.4",
              "status": "affected"
            },
            {
              "version": "15.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-11T13:25:05.507174Z",
          "id": "CVE-2026-44763",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3759854",
      "source": "[email protected]"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]"
    }
  ]
}