Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Successful exploitation of this vulnerability simply requires the attacker or targeted user to leverage a Microsoft Access application to automatically talk to a SQL Server while utilizing a remote SQL Server address that they control.
How could an attacker exploit this vulnerability?
An authenticated attacker can run arbitrary SQL queries as the SMS service (with sysadmin privileges). Since the injection happens during a user permission check, even users with read-only RBAC roles can exploit it. Any local SMS Admins group member on the SMS Provider host can also take advantage of this vulnerability.
Security updates
5.00.9135.1003 — https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2503/31909343
Vulnerabilities 1
-
High 8.0CVE-2025-47178 Public exploit
Microsoft Configuration Manager Remote Code Execution Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to execute code over an adjacent network.
Revision history
-
#1
Information published.
References
-
CVE-2025-47178 Microsoft Configuration Manager Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47178
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss