CVE-2026-44763

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44763", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-05-07T18:39:44.146Z", "datePublished": "2026-08-11T00:11:42.115Z", "dateUpdated": "2026-08-11T14:32:54.667Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-08-11T00:11:42.115Z"}, "title": "Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Manufacturing Integration and Intelligence", "versions": [{"status": "affected", "version": "XMII 15.4"}, {"status": "affected", "version": "15.5"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker\ufffds control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker\ufffds control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3759854"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T13:25:05.507174Z", "id": "CVE-2026-44763", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T14:32:54.667Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44763", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T13:25:05.507174Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T14:32:49.880Z"}}], "cna": {"title": "Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Manufacturing Integration and Intelligence", "versions": [{"status": "affected", "version": "XMII 15.4"}, {"status": "affected", "version": "15.5"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3759854"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker\ufffds control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker\ufffds control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-08-11T00:11:42.115Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44763", "state": "PUBLISHED", "dateUpdated": "2026-08-11T14:32:54.667Z", "dateReserved": "2026-05-07T18:39:44.146Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-08-11T00:11:42.115Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Manufacturing Integration and Intelligence", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "XMII 15.4"}, {"status": "affected", "version": "15.5"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker\ufffds control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integrity, and availability."}, {"lang": "es", "value": "SAP Manufacturing Integration y Intelligence permite a un atacante privilegiado explotar una validaci\u00f3n insuficiente de rutas de archivo en ciertas funciones utilizando una entrada especialmente dise\u00f1ada. La explotaci\u00f3n tambi\u00e9n requiere que un usuario leg\u00edtimo acceda posteriormente al contenido influenciado por el atacante y depende de condiciones fuera del control del atacante. Una explotaci\u00f3n exitosa podr\u00eda permitir que se escriban archivos fuera del directorio previsto y afectar a otros componentes, lo que resultar\u00eda en un alto impacto en la confidencialidad, integridad y disponibilidad."}], "id": "CVE-2026-44763", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 6.0, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44763", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T13:25:05.507174Z", "version": "2.0.3"}}]}, "published": "2026-08-11T01:17:20.930", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3759854"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "XMII 15.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "15.5"}}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "SAP Manufacturing Integration and Intelligence", "source": "cna", "vendor": "SAP_SE"}, "product": "manufacturing_integration_and_intelligence", "vendor": "sap"}], "created": "2026-08-11T01:45:06.848785+00:00", "updated": "2026-08-11T14:00:14.142377+00:00", "vendors": ["sap", "sap$PRODUCT$manufacturing_integration_and_intelligence"]}