Advisory
A note with CVSS 9.1 for component MFG-MII was released by SAP on 11.08.2026. The correction/advisory 3758900 was described with "3758900 - [CVE-2026-44758] Code Injection vulnerability in Manufacturing Integration and Intelligence" and affects the system type Java.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process.
The vulnerability addressed is remote code execution vulnerability within Java.
Risk specification
SAP Manufacturing Integration and Intelligence (MII) allows an authenticated attacker to submit specially crafted input to certain affected functionality that is processed without sufficient validation, resulting in the execution of arbitrary commands on the underlying operating system.
Solution
The vulnerable XSL transformation servlet component has been removed from MII. XSL transformations should now be performed using the XSL transform action block. Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "Do not provide the action XMII_IllumXSLTServlet to any role. Without this action, the vulnerable servlet cannot be accessed. If the servlet is being accessed as a service in any implementation, use the XSL Transformation action block instead.".
Affected System
SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform. It provides the complete infrastructure for deploying and running Java applications.
- The AS Java Home: SAP Netweaver Application Server Java wiki
- A dedicated SAP NetWeaver 7.40 Application Server for Java Security Guide exists.
The advisory is valid for
