Microsoft's SCCM Lets Attackers Compromise Enterprise Fleets for $58 Until October

A security researcher at XM Cyber has demonstrated that an ordinary Active Directory domain user — someone with zero SCCM privileges — can chain four distinct vulnerabilities in Microsoft Configuration Manager to seize full SYSTEM-level control of the primary site server, and from there, command every endpoint the platform manages. Microsoft patched the chain's entry point — tracked as CVE-2026-47301 — in July. The other three links remain unaddressed until ConfigMgr 2609, which is planned for October. The SentinelOne CVE-2026-47301 advisory rates the vulnerability CVSS 8.8 HIGH under CWE-284 Improper Access Control.

For enterprise IT teams, the arithmetic is stark: one patch applied, three vulnerabilities intact, and the signing barrier that should block unauthorized code can be crossed with a commercially available certificate that cost the researcher $58. The full disclosure appears in CSO Online , reported by Shweta Sharma on August 13, 2026.

Microsoft Configuration Manager — still widely known by its legacy acronym SCCM — is the on-premises platform that pushes operating system images, distributes patches, runs compliance checks, and enforces software policy across thousands of Windows endpoints simultaneously. In an enterprise environment, the primary site server is the node from which all of that authority flows. Compromising it does not give an attacker a single machine — it gives them the same administrative reach the IT department has over every managed device in the organization.

XM Cyber researcher Omri Baso put it directly: Baso told CSO Online that after the site server is compromised, all of its managed clients are compromised as well, which usually means taking over all the company assets. That reach includes the ability to push arbitrary software, disable endpoint protection agents, and pivot laterally across a network with near-zero friction — capabilities that make SCCM access an amplifier in ransomware and nation-state intrusion scenarios.

The attack requires network access to the SCCM environment and valid Active Directory credentials. Nothing else.

Link 1 — The Authorization Gap (CVE-2026-47301): SCCM's AdminService REST API exposes two upload endpoints. The standard extension-upload endpoint enforces permission checks. Its chunked-upload counterpart does not. chunked-upload authorization gap — one code path enforcing RBAC, the other ignoring it — lets any authenticated domain user submit a malicious CAB archive to the server without holding a single SCCM role. This is the only link Microsoft has patched so far.

Link 2 — CabSlip, a Path Traversal: Once a CAB archive reaches the server, a path-traversal flaw Baso named CabSlip allows files inside it to escape the intended extraction directory and land anywhere the service process can write. Path traversal is a well-documented vulnerability class — OWASP lists it as CWE-22, a problem considered solved when extraction logic normalizes paths before writing. Its appearance in a platform managing Fortune 500 infrastructure reflects the systemic secure-coding challenges that security researchers have been documenting in ConfigMgr for years. Synacktiv's DEF CON 33 SCCM research catalogued this pattern in August 2025. CabSlip is not fixed.

Link 3 — What $58 Actually Buys: SCCM validates signatures on content it processes. The validation confirms structural correctness and checks that the certificate has not expired. It does not verify that the signing certificate chains to Microsoft's certificate authority or to the organization's own CA. Certificate revocation checking is disabled.

The implication is significant beyond this single vulnerability: the trust boundary protecting ConfigMgr's content pipeline is not an organizational identity check — it is a format check. Any commercially purchased code-signing certificate, from any of the hundreds of certificate authorities that issue them globally, satisfies it. For his research, Baso purchased a Certum Open Source Developer Certificate. The cost was approximately $58. Revocation is disabled, so even a certificate that has been reported as compromised remains valid for SCCM's purposes. This flaw is not fixed.

Link 4 — The SYSTEM Foothold: The file-write capability that CabSlip provides is the key to obtaining execution. The SMS Executive service — which runs with NT AUTHORITYSYSTEM privileges, the highest available on a Windows machine — loads a secondary library named adsource.dll from a predictable path without verifying its signature. Replacing that library with a malicious one, using CabSlip's arbitrary write, causes SYSTEM-level code execution the time the service loads it. This flaw is not fixed.

Microsoft's July fix for CVE-2026-47301 closes the entry point for standard domain users. The chunked-upload authorization gap is no longer accessible to arbitrary AD accounts.

However, a residual path survives. Users assigned the built-in Operations Administrator role, or any custom role granted Create permission on "SMS_ConsoleExtensionData," residual downstream path survives . Baso qualifies the risk: XM Cyber believes organizations are unlikely to face this route, because Operations Administrator is already a highly privileged role. Accounts with that role are not typical attack surfaces for standard lateral movement.

More consequentially, the CabSlip path traversal, the commercial-certificate signing bypass, and the unsigned adsource.dll load are not patched at all. They are confirmed code defects that any future authorization bypass — or a future researcher's discovery of a different entry point — could chain to. Microsoft did not respond to CSO Online's request for on the unpatched flaws. The full fix is expected in ConfigMgr 2609, which is planned for October 2026.

This disclosure does not arrive in isolation. Security researchers have repeatedly found critical vulnerabilities in the same platform.

CVE-2024-43468, a CVSS 9.8 unauthenticated SQL injection in the MP_Location service, was patched in October 2024, actively exploited in the wild by early 2026, and added to CISA's Known Exploited Vulnerabilities catalog in February 2026 with a federal agency remediation deadline of March 5. At DEF CON 33 in August 2025, Synacktiv researcher Mehdi Elyassa presented a session titled "SCCM: The tree that always bears bad fruits," cataloguing the platform's recurring vulnerability pattern and suggesting systemic issues in its development security practices.

CVE-2025-47178, another SQL injection, was documented in mid-2025. Security analysts have noted that the concentration of recurring critical flaws in a single platform responsible for enterprise-wide code distribution is a disproportionate risk: each vulnerability discovered represents not just a compromise of one machine, but a potential mechanism to push malicious software to every managed endpoint simultaneously.

Microsoft has signaled that ConfigMgr will move to an annual release cadence, with future investment flowing toward its cloud-based Intune suite. A slower patch cycle for a platform with a documented history of critical security debt warrants attention from enterprise security architects who have not yet evaluated migration timelines.

The following actions should be taken in priority order. None require waiting for ConfigMgr 2609.

Apply the July 2026 patch for CVE-2026-47301 immediately. This is table stakes. The entry-point fix for standard domain users is available now. Organizations that have not yet applied it are exposed to the full four-link chain.

Restrict network access to the AdminService API. The attack requires network reachability to the SMS Provider and AdminService endpoints. Firewall rules limiting TCP 443 access to designated administrative subnets eliminate the most accessible attack surface for both the patched and the residual path.

Audit RBAC assignments. Identify every account holding the Operations Administrator role or any custom role with Create permission on SMS_ConsoleExtensionData. Reduce those assignments to the minimum required and ensure they correspond to dedicated, actively monitored identities.

Monitor AdminService.log for the traversal signature. XM Cyber identified a specific log pattern indicating that CabSlip has been triggered: a specific log pattern — AdminService.log CabSlip indicator — in AdminService.log on the primary site server. Teams that surface this pattern should treat it as an active incident signal.

Watch adsource.dll for unexpected modification. Any change to adsource.dll in the Configuration Manager installation directory outside a planned maintenance window should be treated as a potential indicator of compromise.

Forward ConfigMgr logs to a SIEM with behavioral baselines. Enable and forward Configuration Manager audit status messages and SMS Provider logs (SMSProv.log, AdminService.log, hman.log) to a centralized SIEM with baselines . Baseline normal administrative activity by account and site role, then alert on deviations — privilege changes, unexpected deployments to broad collections, or new administrative assignments originating from non-admin identities.

Partly. The July patch closes the entry-point authorization gap for standard domain users — the most readily exploitable route into the chain. However, three downstream flaws remain unpatched: the CabSlip path traversal, SCCM's commercial-certificate signing bypass, and the unsigned DLL load in SMS Executive. A separate residual path also survives for accounts with the Operations Administrator role, though XM Cyber considers this route unlikely in practice. The full fix is not expected until ConfigMgr 2609 in October. Network restrictions and RBAC audits are essential compensating controls in the interim.

It should, but only if the signing validation checks that the certificate chains to a trusted organizational or vendor authority. SCCM's validation checks that a signature is structurally valid and that the certificate has not expired — but it does not verify organizational chain-of-trust, and certificate revocation checking is disabled. That means any certificate from any commercial certificate authority, purchased by any individual, satisfies the check. Code-signing trust is only as strong as the identity verification behind it; SCCM's current design treats commercial CA issuance as sufficient proof of trust, which it is not.

When SCCM's primary site server is compromised, the attacker inherits its administrative authority over every Windows endpoint the platform manages. In practice, that means the ability to deploy arbitrary software to every managed machine, modify security policies and compliance baselines, disable endpoint protection agents, collect hardware and software inventory, and pivot laterally across the network. In large enterprise environments, SCCM may manage tens of thousands of servers, desktops, and laptops. Site server access is effectively domain-level reach over every managed asset.

Microsoft patched CVE-2026-47301 in July 2026. The three remaining flaws — CabSlip, the signing validation weakness, and the unsigned DLL load — are expected to be addressed in ConfigMgr 2609, which Microsoft has planned for October 2026. Microsoft did not respond to requests for on the timeline or the specific remediation approach for the unpatched links.