Critical Microsoft SCCM Vulnerability Lets Attackers Execute Remote Code

Key Takeaways

• A critical attack chain in Microsoft System Center Configuration Manager (SCCM) allows remote code execution on primary site servers.
• The vulnerabilities, initially reported by XM Cyber, can be triggered by a standard Active Directory domain user without elevated privileges.
• One critical authorization bypass (CVE-2026-47301) was patched by Microsoft in July 2026, but other elements of the attack chain remain unaddressed.
• Successful exploitation could lead to full control over an organization’s Windows environment, running malicious code with SYSTEM privileges.

Unpatched SCCM Flaws Enable Remote Code Execution

Cybersecurity researchers have uncovered a severe multi-stage attack chain impacting Microsoft System Center Configuration Manager (SCCM), also known as Configuration Manager. This series of vulnerabilities could enable an attacker to execute arbitrary code remotely on an SCCM primary site server, potentially giving them complete control over an organization’s managed Windows infrastructure.

The severity of this exploit is heightened by its low barrier to entry: a standard Active Directory domain user, without any SCCM administrative permissions, elevated Windows privileges, or user interaction, can initiate the attack. The target, the SCCM primary site server, is a cornerstone of enterprise IT, responsible for critical functions such as software deployment, patching, OS installation, compliance, and device management.

The Discovered Vulnerability Chain

XM Cyber reported the vulnerabilities to Microsoft on May 23, 2026. Microsoft subsequently assigned CVE-2026-47301 to an authorization bypass component of the chain and released a patch on July 14, 2026. However, XM Cyber researchers note that several other critical weaknesses within the attack chain remain unpatched. Microsoft has indicated these will be addressed in ConfigMgr 2609, anticipated for release in October 2026.

The initial entry point involved a flaw in SCCM’s AdminService REST API. While a standard endpoint for uploading console extension packages via CAB archives correctly enforced role-based access control, a “chunked upload” endpoint failed to perform the same authorization check. This oversight permitted authenticated domain users to upload specially crafted CAB files to the server, bypassing security restrictions.

Another weakness was identified in SCCM’s signature validation process. Although the system verified the presence of an embedded signature within a CAB archive, it reportedly did not confirm that the signing certificate originated from Microsoft or the victim organization. Additionally, certificate revocation checks were bypassed. This allowed attackers to use any valid certificate, even if not trusted, to sign and upload a malicious extension package.

Researchers also discovered a path traversal vulnerability, dubbed “CabSlip.” During CAB archive extraction, SCCM did not adequately prevent relative path sequences. This allowed a maliciously crafted archive to write files outside its designated temporary extraction directory, granting attackers arbitrary file write access on the site server.

The final stage of the attack leveraged a DLL loading vulnerability within the SMS Executive service, which operates with NT AUTHORITYSYSTEM privileges. While the service validates its primary DLL, it loads a secondary DLL named adsource.dll without performing equivalent integrity checks. An attacker could exploit the path traversal flaw to overwrite this adsource.dll. When SCCM later loads the compromised library, the malicious code would execute with SYSTEM privileges, effectively granting full control.

Microsoft’s July update addressed the initial authorization bypass, preventing standard domain users from exploiting the chunked upload endpoint. Nevertheless, users with the built-in Operations Administrator role, or a custom role configured with “Create” permission on the SMS_ConsoleExtensionData object, may still be able to access and exploit the subsequent stages of the attack chain.

What You Should Do

• Monitor SCCM Logs: Actively review AdminService.log for instances of DirectoryNotFoundException errors followed by HTTP 500 responses. Investigate any suspicious or unexpected CAB upload activity.
• Inspect adsource.dll: Monitor for unauthorized changes to the adsource.dll file within your Configuration Manager installation directory.
• Restrict Network Access: Implement strict network access controls for the AdminService port, limiting its exposure to only necessary internal systems.
• Review Role Assignments: Urgently audit and restrict SCCM role assignments, particularly those with “Create” permission on the SMS_ConsoleExtensionData object, until Microsoft releases a comprehensive fix.
• Apply Updates: Ensure the July 2026 patch for CVE-2026-47301 is applied immediately. Plan to deploy the ConfigMgr 2609 update promptly when it becomes available in October 2026.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.