# CVE-2026-44758: Code Injection vulnerability in Manufacturing Integration and Intelligence

- Exploited (CISA KEV): no
- Published: 2026-08-11
- CVSS: 9.1 CRITICAL (v3.1)
- EPSS: 0.8% (56th percentile)
- CWE: CWE-94

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability of the application.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2026-09-16 | 36 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2026-09-16 · new · rule 200204096
  > Added: signature 200204096 "SAP MII Code Injection" (Server Side Code Injection, risk High), systems: Other Web Server. References: CVE-2026-44758.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-44758 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-44758