The 'high privileges' requirement on this CVE is misleading if you're using standard external-threat prioritization models. In SAP MII deployments, those privileges aren't an attack barrier — they're the default operating state. MII transactions run under service accounts that already have implicit OS-level trust within manufacturing networks, and the platform explicitly allows transaction developers to pass parameters to backend systems as a first-class feature. The 'high privilege' requirement means the attacker needs a seat inside the trusted tier, not that there's a meaningful boundary to cross.
The CVSS 9.1 score actually understates the real risk. MII service accounts in manufacturing environments typically carry trust relationships with SCADA historians, MES databases, and in some architectures, direct OT network access for recipe synchronization. Command injection at the MII tier doesn't just compromise the application server — it potentially reaches into the systems that control physical production processes. Standard patch-priority models and SAP GRC role analysis structurally miss this because they're built for IT blast-radius assessment, not OT implications.
Here's what defenders are likely missing: the unpatched attack surface is probably an order of magnitude larger than your asset inventory shows. MII transactions written for production lines that were retooled years ago, deployed by developers who left the company, documented in archived SharePoint sites — these transactions aren't receiving patches because nobody remembers they exist. The 'high privilege' requirement doesn't just mean the attacker needs an insider; it means the blast radius travels through account configurations that have accrued permissions across MII version upgrades and acquisition integrations without re-baselining.
When the patch arrives, expect input validation — and expect a follow-on bypass CVE within 12-18 months, as that's the historical pattern for OS command injection in trusted-internal platforms. The deeper fix, architectural lockdown that actually removes OS-call paths from the transaction tier, would break backward compatibility for every MII developer who built integrations around this capability. That's why this vulnerability class will persist: the economically painful fix is the only one that actually works.