Your ERP Is a Plant Floor Control System – Nobody Scoped It That Way
SAP shipped a 9.9 in August for the software sitting between your plant floor and your order book. Whose patch window owns it?
Your line does not stop when a controller fails. It stops when nothing tells the controller what to build.
On 11 August, SAP released a fix for CVE-2026-44772, scored 9.9, in SAP Manufacturing Integration and Intelligence. MII is the translation layer between plant floor assets and ERP business logic. The flaw allows remote code execution through malicious transformation logic, and Onapsis notes that a low-privilege service account is enough to reach it. That describes most of the accounts living in a plant network.
Ask who owns that patch at your company. The answer is usually a Basis team working an enterprise calendar, and your OT risk register has no line for it.
The systems that stop a line are not on the control network. Order is the first of them.
Order release is a control function wearing a business label
Sequencing decides which order runs next, and recipe selection decides what the equipment is set to when it runs. Both determine the physical behavior of your plant. Shipment authorization decides whether the finished pallet is allowed to leave. Those are control decisions. They carry a business label because they run on a server in a data center rather than in a panel on the floor, and your scope followed the label.
Call it the order tether, the first strand of the IT tether. It decides whether work exists.
The failure you should worry about is release, not production
The obvious version is a line with nothing to build. Most plant managers I talk to have already argued their way past it, and they are right to. MES caches recipes. Operators keep going on staged work. A well-run site absorbs a few hours of this without an alarm reaching anyone senior.
Quality is where it stops being survivable. Batch records, recipe versions and electronic signatures live in the same systems. A food or pharmaceutical plant that cannot produce a batch record cannot release product it has already made. The line runs. The warehouse fills. Nothing ships, and every hour of production adds inventory you are not yet allowed to sell.
What it cost the one company that had to file about it
Clorox disclosed a cyberattack on 14 August 2023 and moved to manual order processing. Manufacturing came back at most sites within weeks. The company was still warning about product outages a month later, on 18 September.
In its SEC filing, Clorox reported 49 million dollars in costs as of 31 December 2023, covering forensics, IT recovery and incremental operating expenses, and told investors the disruption had a material impact on the quarter ended 30 September 2023.
No attacker touched a controller in that sequence. The plants could make product. The company could not decide what to make, or ship what it had made.
Two calendars, one system, no owner
An enterprise patch window gets scheduled around month end and financial close. A production patch window gets scheduled around a changeover or a shutdown. Those calendars share nothing, and MII sits inside both.
What happens next is predictable. The OT team assumes the SAP estate is covered because it is a corporate application. The Basis team assumes anything touching production needs plant approval they have not been asked for. A 9.9 waits for a window neither group believes they own.
How the good ones triage a 9.9 they do not own
They rate the order path by production impact rather than by CVSS. A vulnerability in the system that authorizes shipment gets triaged against tonnes and orders, not against a severity score that knows nothing about your plant.
They also rehearse the shift. One site, one changeover, order release unavailable, and somebody times how long the plant keeps producing sellable product. The number that comes out of that exercise is the only honest input to the recovery conversation.
What you can do this week
If you’re a plant or OT leader: List the production decisions your site cannot make without ERP or MES, separating what stops the line from what stops the shipment. Name which of the two arrives first at your site.
If you’re a CISO or enterprise risk lead: Find out who patched CVE-2026-44772 and when. If nobody can answer inside a day, you have found the ownership gap rather than a patching problem.
If you’re a COO or CFO: Ask what your plants can produce and release with the order systems down, and for how long. Then ask who has tested that answer rather than estimated it.
A final thought
The comfortable reading is that ERP is an IT system with an IT owner and an IT recovery plan. That reading survived until the quarter Clorox had to describe to investors. Your ERP decides what your factory does with its day, and a system that decides what a factory does is a control system whatever the org chart calls it.
Your turn
Take your highest-volume site. With order release unavailable, how many hours until it produces something it cannot ship? And is that number measured, or is it the one somebody offered in a meeting?
This post is part of The IT Tether series. Read every chapter in one place in The IT Tether eBook, or book a demo to see how Resilion maps what stops your line.