Advisory
A note with CVSS 9.9 for component MFG-MII was released by SAP on 11.08.2026. The correction/advisory 3765948 was described with "3765948 - [CVE-2026-44772] Code Injection vulnerability in SAP Manufacturing Integration and Intelligence" and affects the system type Java.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance.
The vulnerability addressed is code injection within Java.
Risk specification
SAP Manufacturing Integration and Intelligence allows an authenticated attacker to submit specially crafted input that causes the application to retrieve and process attacker-controlled content from an external source, enabling the execution of arbitrary commands on the underlying host with an impact beyond the vulnerable component. This can result in unauthorized access to protected data and potential compromise of the underlying system.
Solution
Two new system properties have been introduced to secure XSL transformations by restricting access to trusted content sources.
Affected System
SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform. It provides the complete infrastructure for deploying and running Java applications.
- The AS Java Home: SAP Netweaver Application Server Java wiki
- A dedicated SAP NetWeaver 7.40 Application Server for Java Security Guide exists.
The advisory is valid for
