Login Request a demo
Medium severity · published Sep 8, 2026
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of scripts. Successful exploitation could result in a low impact on the confidentiality, integrity, and availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
SAP Manufacturing Integration and Intelligence · SAP_SE
XMII 15.4; 15.5 · source: vendor
Affected product
SM
SAP Manufacturing Integration and Intelligence
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76971
me.sap.com
https://me.sap.com/notes/3786489
url.sap
https://url.sap/sapsecuritypatchday
More from SAP Manufacturing Integration and Intelligence
9.1
CVE-2026-44758
Code Injection vulnerability in Manufacturing Integration and Intelligence
8.8
CVE-2019-0267
SAP Manufacturing Integration and Intelligence, versions 15.0, 15.1 and 15.2, (Illuminator Servlet) currently does not provide Anti-XSRF tokens
7.6
CVE-2026-44763
Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence
7.3
CVE-2026-44765
Missing Authorization Check in SAP Manufacturing Integration and Intelligence
7.3
CVE-2026-44764
Missing Authorization Check in SAP Manufacturing Integration and Intelligence