CVE-2026-44764 is a missing authorization check in an SAP MII servlet handling cost calculation operations. Treat this as a high-severity issue regardless of the 7.3 CVSS score—the metric understates the actual exposure.
The critical detail in the disclosure is the phrase 'specific parameter values.' This isn't a binary authorized/unauthorized bypass. The vulnerability exists because the servlet makes authorization decisions based on which parameters are passed rather than who is calling. This means different parameter combinations grant access to different operations (read, create, modify, delete). You have an enumeration surface: every parameter value an attacker tests reveals what operations exist and what they do. This transforms the vulnerability from a simple auth bypass into a discovery mechanism.
The Cost Servlet is almost certainly a legacy artifact—integration platforms like MII accumulate these endpoints over years as teams add service-to-service communication paths that were assumed to be internally trusted. The authorization check wasn't necessarily removed; it was likely never implemented because the original design assumed authenticated internal callers. This is the 'trusted path assumption' failure that creates the vulnerability surface.
What makes this dangerous post-disclosure: the CVE description itself becomes reconnaissance material. Attackers now have the 'specific parameter values' language as a map to your attack surface. A 7.3 score won't receive emergency patching priority, creating a compounding window where disclosed-but-unfixed parameter combinations become the most efficient attack vector.
Action items: First, identify whether you have any MII servlets handling business operations (cost, pricing, inventory) that haven't been reviewed for authorization. Check if they're exposed to unauthenticated callers—don't assume internal network access equals trusted callers. Second, review your access logs for unusual parameter enumeration patterns against any MII endpoint. Deprecated servlets often fall off monitoring lists while remaining active. Third, map the downstream dependencies: this servlet sits between shop floor operations and ERP systems. Cost data feeds financial reporting and procurement triggers. Even 'limited impact' on the servlet itself doesn't capture the relay risk into automated business processes. Fourth, treat the CVSS score as a lower bound—the post-disclosure risk profile is categorically more dangerous than pre-disclosure because the vulnerability is now announced and weaponizable.