Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What privileges could be gained by an attacker who successfully exploited the vulnerability?
An authorized attacker who successfully exploited this vulnerability could gain configuration manager administrator privileges.
How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by injecting malicious SQL into the DuplicateAMTMachineRecord method.
Security updates
5.00.9132.1029 — https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2503/34503790
Vulnerabilities 1
-
High 8.8CVE-2025-59213 Public exploit
Configuration Manager Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges over an adjacent network.
Revision history
-
#2
Updated information to include CVSS scores. This is an informational change only.
-
#1
Information published.
References
-
CVE-2025-59213 Configuration Manager Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59213
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss