CVE-2026-47301 is an improper access control vulnerability [CWE-284] in Microsoft Configuration Manager. An authenticated attacker with low privileges can elevate privileges over a network without user interaction. The flaw affects multiple current branch releases including Configuration Manager 2503 , 2509 , and 2603 .
Microsoft Configuration Manager, part of the Microsoft Endpoint Manager family, is widely deployed in enterprise environments to manage software distribution, patching, and device configuration. A successful attack against this component can compromise confidentiality, integrity, and availability of managed systems across the enterprise.
An authenticated network attacker can elevate privileges within Microsoft Configuration Manager, potentially gaining administrative control over managed endpoints and the deployment infrastructure.
The vulnerability stems from improper access control within Microsoft Configuration Manager. The affected component fails to correctly enforce authorization checks before executing privileged operations requested over the network. An attacker who already holds low-privileged credentials on the network can invoke operations reserved for higher-privileged roles.
Because Configuration Manager coordinates software deployment, script execution, and configuration policy across managed endpoints, elevated access can be leveraged to reach systems beyond the initial foothold. Successful exploitation results in high impact to confidentiality, integrity, and availability of the Configuration Manager site.
The issue is classified under CWE-284 (Improper Access Control). Attack complexity is low, and no user interaction is required, which lowers the effort required for an authenticated adversary to weaponize the flaw.
The root cause is an authorization gap in a network-reachable interface exposed by Configuration Manager. Requests from authenticated users are processed without adequate validation of the caller's assigned role or scope, allowing operations to run in a higher privilege context than intended.
Exploitation requires network access to the Configuration Manager site and valid low-privileged credentials. The attacker sends crafted requests to the vulnerable interface, triggering privileged actions such as configuration changes, deployment operations, or access to protected data. From that position, the attacker can pivot to managed clients or extract sensitive configuration data.
No verified public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft CVE-2026-47301 Advisory for technical specifics.
Microsoft has issued guidance and updates through the Microsoft Security Response Center. Administrators should follow the vendor advisory at Microsoft CVE-2026-47301 Advisory to obtain the appropriate hotfix or in-console update for the deployed Configuration Manager version.
Disclaimer : This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
