Security researchers have recently identified a critical vulnerability chain impacting Microsoft System Center Configuration Manager (SCCM). These flaws present a risk of remote code execution on SCCM primary site servers, potentially compromising an organization’s entire Windows management infrastructure.
Understanding the SCCM Vulnerabilities
The vulnerabilities are particularly alarming because they can be initiated by a standard Active Directory domain user without needing administrative permissions or elevated privileges. This makes the attack vector accessible to many potential bad actors.
The primary target of these attacks is the SCCM primary site server. This server is crucial as it manages software deployment, operating system installations, and compliance monitoring across the network, making it a high-value target for attackers.
Details of the Discovered Flaws
XM Cyber brought these vulnerabilities to Microsoft’s attention on May 23. Microsoft acknowledged the broken authorization issue by assigning it CVE-2026-47301 and provided a fix on July 14, 2026. Despite this, other vulnerabilities in the chain remain unpatched and are expected to be addressed in the upcoming ConfigMgr 2609 update in October 2026.
The first issue involves the SCCM AdminService REST API, where a lack of proper authorization checks at a chunked upload endpoint allows authenticated users to submit malicious CAB files.
Exploiting Weaknesses in SCCM
Another significant flaw is associated with the signature validation process. Although SCCM checks for a valid signature on CAB files, it does not ensure the signing certificate is from trustworthy sources, like Microsoft or the victim organization, nor does it perform certificate revocation checks. This loophole allows attackers to upload harmful extension packages.
Researchers also discovered a path traversal vulnerability, termed “CabSlip,” which allows attackers to write files outside the designated extraction folder, resulting in arbitrary file write access.
The final stage of the attack exploits the SMS Executive service’s DLL loading behavior, enabling attackers to execute malicious code with SYSTEM privileges by replacing a secondary DLL named adsource.dll.
Mitigation and Future Outlook
While Microsoft’s recent updates have blocked some attack paths, particularly for standard domain users at the chunked upload endpoint, certain roles like Operations Administrator can still exploit these vulnerabilities. Organizations are advised to restrict access to the AdminService network port, scrutinize SCCM role assignments, and closely monitor logs for suspicious activities.
Until a comprehensive fix is released, it is crucial for organizations to remain vigilant and implement recommended security measures to mitigate potential risks associated with these SCCM vulnerabilities.
