CVE-2026-76971— Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence
Quick assessment
Affected
SAP_SE SAP Manufacturing Integration and Intelligence
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
由于 SAP Manufacturing Integration and Intelligence 中存在服务器端请求伪造（SSRF）漏洞，攻击者可以诱导服务器发起任意外部请求。如果这些请求被应用程序处理，该行为可与 XML/XSL 处理相结合，从而可能实现脚本执行。成功利用此漏洞可能导致应用程序的机密性、完整性和可用性受到低级别的影响。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1011 · Exfiltration Over Other Network Medium
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76971
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence
Source: CVE Program / CVE List V5
Vulnerability Description
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of scripts. Successful exploitation could result in a low impact on the confidentiality, integrity, and availability of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Manufacturing Integration and Intelligence | XMII 15.4 | - |
|
II. Public POCs for CVE-2026-76971
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76971
请登录查看更多情报信息。
Vendor Pages for CVE-2026-76971 (1)
Same Patch Batch · SAP_SE · 2026-09-08 · 17 CVEs total
| CVE-2026-44756 | 10.0 CRITICAL | Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing |
| CVE-2026-58240 | 9.8 CRITICAL | Missing Authentication check in SAP NetWeaver (Message Server) |
| CVE-2026-76969 | 9.4 CRITICAL | Credential disclosure in multitenant applications using SAP Cloud Application Programming |
| CVE-2026-66768 | 9.0 CRITICAL | Improper Access Control in SAP NetWeaver (SAP GUI for Java) |
| CVE-2026-76958 | 8.5 HIGH | XML External Entity (XXE) Vulnerability in SAP Integration Suite |
| CVE-2026-76967 | 7.8 HIGH | Insecure Deserialization in SAP NetWeaver Business Client |
| CVE-2026-66767 | 7.7 HIGH | Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Plat |
| CVE-2026-76968 | 6.5 MEDIUM | Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager |
| CVE-2026-44766 | 6.5 MEDIUM | SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation) |
| CVE-2026-76959 | 4.6 MEDIUM | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payme |
| CVE-2026-76977 | 4.3 MEDIUM | Clickjacking vulnerability in SAPUI5(Frame Options Allowlist) |
| CVE-2026-76963 | 4.3 MEDIUM | Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform |
| CVE-2026-76962 | 4.3 MEDIUM | Missing Authorization check in SAP S/4HANA (Manage Bank Chains app) |
| CVE-2026-76961 | 3.5 LOW | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payme |
| CVE-2026-76960 | 3.5 LOW | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payme |
| CVE-2026-58234 | 2.2 LOW | Denial of Service vulnerability in SAP Process Integration (SOAP Adapter) |
IV. Related Vulnerabilities
Same product: SAP Manufacturing Integration and Intelligence
-
CVE-2026-58244
Missing Authorization Check in SAP Manufacturing Integration -
CVE-2026-44765
Missing Authorization Check in SAP Manufacturing Integration -
CVE-2026-44764
Missing Authorization Check in SAP Manufacturing Integration -
CVE-2026-44763
Directory Traversal vulnerability in SAP Manufacturing Integ -
CVE-2026-44758
Code Injection vulnerability in Manufacturing Integration an
Same vendor: SAP_SE
-
CVE-2026-76977
Clickjacking vulnerability in SAPUI5(Frame Options Allowlist -
CVE-2026-76969
Credential disclosure in multitenant applications using SAP -
CVE-2026-76968
Information Disclosure vulnerability in SAP Web Dispatcher, -
CVE-2026-76967
Insecure Deserialization in SAP NetWeaver Business Client -
CVE-2026-76963
Missing Authorization Check in Application Server ABAP of SA
Same weakness: CWE-918
-
CVE-2026-86590
Eclipse Che 7.79.0-7.121.0 服务端请求伪造（SSRF） -
CVE-2026-81806
WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Re -
CVE-2026-86539
knowns through 0.33.0 Server-Side Request Forgery via embedd -
CVE-2026-82757
ash_authentication_oauth2_server CIMD fetcher classifies IPv -
CVE-2026-86503
IntelliJ IDEA <2026.2.2 打开项目触发SSRF
V. Comments for CVE-2026-76971
No comments yet