Public Exploit Released for Critical Microsoft SCCM RCE Vulnerability CVE-2023-35887

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-47301, affecting Microsoft Configuration Manager (SCCM) now has a public proof-of-concept (PoC) exploit.
• The exploit allows a low-privileged domain user to achieve SYSTEM-level access on a Configuration Manager Primary Site Server.
• This flaw poses a significant risk for enterprise compromise, enabling lateral movement and sensitive data access.
• Organizations are urged to apply Microsoft’s security updates immediately and implement enhanced monitoring.

Public Exploit Emerges for Critical Microsoft SCCM Vulnerability

A functional public exploit has been released for CVE-2026-47301, a severe remote code execution vulnerability impacting Microsoft Configuration Manager (SCCM). This development significantly elevates the threat level for organizations utilizing the widely deployed enterprise management solution.

The newly disclosed exploit chain enables an attacker with minimal domain privileges to gain SYSTEM-level execution on an SCCM Primary Site Server. Such a compromise could grant adversaries extensive control over an organization’s Windows environment, presenting a substantial risk for widespread enterprise takeover.

Understanding the Exploit Chain

Security researcher Omri Baso published a proof-of-concept repository, which includes the full source code, project files, a specially crafted CAB archive, and a compiled release. Baso characterized CVE-2026-47301 not as a singular flaw, but as a sophisticated multi-stage exploit chain leveraging several distinct weaknesses.

The attack vector for CVE-2026-47301 reportedly combines several vulnerabilities: flawed access control, path traversal during the extraction of CAB files, the ability to write arbitrary files, a bypass for certificate verification, and DLL hijacking. In combination, these vulnerabilities allow an attacker to strategically place malicious files within the Configuration Manager installation directory, which a privileged SCCM service then loads and executes.

The exploit specifically targets the SMS_EXECUTIVE service, a critical SCCM component that operates with elevated privileges. The research indicates that a maliciously constructed CAB file can be used to write DLL files outside their designated extraction path by exploiting traversal sequences. These files are ultimately placed in the Configuration Manager binX64 directory, where the SMS_EXECUTIVE service is programmed to load them. The PoC implements a DLL proxying technique involving adsource.dll and adsource_original.dll.

The malicious DLL is engineered to execute attacker-controlled code while simultaneously passing legitimate functionality to the original library. This method helps prevent the SCCM service from crashing, thus reducing the likelihood of immediate detection. The researcher noted that the relevant DLL loading event may occur on a recurring schedule, meaning the effects of a successful exploitation might not be immediately apparent.

Identifying and Mitigating Risk

A successful attack hinges on identifying the SCCM Primary Site Server. While this information might not be explicitly published in Active Directory, Baso’s research suggests it can be inferred by scrutinizing permissions within the System Management container. Domain computer accounts granted Full Control or GenericAll permissions over this container are strong indicators of Configuration Manager site servers.

The public availability of this exploit code significantly intensifies the risk for organizations that have not yet applied Microsoft’s security updates. SCCM servers are particularly attractive targets for adversaries due to their central role in managing software deployment, endpoint configuration, and administrative tasks across vast enterprise Windows environments. Achieving SYSTEM-level code execution on a Primary Site Server offers attackers a potent platform for lateral movement, deploying malware, stealing credentials, or initiating ransomware campaigns.

The published PoC demonstration CAB includes actions such as enabling and modifying the built-in RID 500 Administrator account. Defenders should consider unexpected changes to this account, the presence of suspicious DLLs within the Configuration Manager installation directory, or unusual activity related to CAB uploads as high-priority indicators requiring immediate investigation.

What You Should Do

• Apply Patches Immediately: Review Microsoft’s advisory for CVE-2026-47301 without delay and apply the relevant security updates to all exposed or unpatched Primary Site Servers.
• Restrict Access: Limit access to SCCM management interfaces to authorized personnel only.
• Audit Permissions: Conduct a thorough audit of permissions within Active Directory’s System Management container to identify and rectify any excessive privileges granted to domain computer accounts.
• Monitor for Anomalies: Implement enhanced monitoring for the SMS_EXECUTIVE service, specifically looking for abnormal DLL-loading events, the presence of unexpected DLLs in the binX64 directory, and any suspicious modifications to the built-in RID 500 Administrator account.
• Incident Response Readiness: Prepare for potential detection and response activities, as the public exploit shifts this from a mere patch-management issue to an urgent cybersecurity incident concern.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.