Security researchers have disclosed a serious attack chain affecting Microsoft System Center Configuration Manager, commonly known as SCCM or Configuration Manager.

The flaws could allow an attacker to execute malicious code remotely on an SCCM primary site server, potentially taking control of an organization’s managed Windows environment.

The attack is especially concerning because a standard Active Directory domain user could start the original chain. The account does not need SCCM administrative permissions, elevated Windows privileges, or user interaction.

A successful attack targets the SCCM primary site server, a critical system responsible for software deployment, patching, operating system installation, compliance monitoring, and device management.

Microsoft SCCM Vulnerability

XM Cyber reported the vulnerabilities to Microsoft on May 23. Microsoft assigned CVE-2026-47301 to the broken authorization issue and released a fix on July 14, 2026.

However, researchers said the remaining weaknesses in the chain are still unpatched. Microsoft plans to address them in ConfigMgr 2609, expected in October 2026.

The first issue involved SCCM’s AdminService REST API. SCCM supports uploading console extension packages through CAB archives. One upload endpoint checked for the required role-based access control permission.

In contrast, a chunked upload endpoint did not perform the same authorization check. This allowed authenticated domain users to submit specially crafted CAB files to the server.

The second weakness affected signature validation. SCCM checked whether a CAB archive had a valid embedded signature, but reportedly did not enforce that the signing certificate belonged to Microsoft or the victim organization.

It also skipped certificate revocation checks. As a result, an attacker could use a certificate that SCCM accepted to sign a malicious extension package.

Researchers also identified a path traversal flaw called “CabSlip.” During CAB extraction, SCCM failed to block relative path sequences properly. A crafted archive could write files outside the intended temporary extraction folder.

This gave attackers arbitrary file write access on the site’s server. The final step abused DLL loading behavior in the SMS Executive service. SMS Executive runs with NT AUTHORITYSYSTEM privileges.

Although it validates a primary DLL, the service can load a secondary DLL named adsource.dll without performing equivalent integrity checks.

An attacker could overwrite that DLL through the path traversal flaw. When SCCM later loads the library, the malicious code would run as SYSTEM. Microsoft’s July update blocks standard domain users from abusing the chunked upload endpoint.

Yet users assigned the built-in Operations Administrator role, or a custom role with Create permission on the SMS_ConsoleExtensionData object, may still access the downstream attack path.

Defenders should monitor AdminService.log for DirectoryNotFoundException errors followed by HTTP 500 responses, inspect unexpected CAB upload activity, and watch for changes to adsource.dll in the Configuration Manager installation directory.

Organizations should also restrict access to the AdminService network port and urgently review SCCM role assignments until Microsoft releases a complete fix.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.