MSRC-CVE-2026-20967 — System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

How could an attacker exploit this vulnerability?
An attacker with any valid SCOM login could create a custom dashboard containing a PowerShell widget, allowing them to run commands on the web console server.

Security updates
10.19.10658.0 — https://learn.microsoft.com/en-us/system-center/scom/release-build-versions?view=sc-om-2019
10.22.11951.0 — https://learn.microsoft.com/en-us/system-center/scom/release-build-versions?view=sc-om-2022
10.25.10377.0 — https://learn.microsoft.com/en-us/system-center/scom/release-build-versions?view=sc-om-2025

Vulnerabilities 1

High 8.8

CVE-2026-20967

System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability

Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.

Microsoft System Center Operations Manager 2022 System Center Operations Manager 2019 System Center Operations Manager 2025

Mar 10, 2026

Revision history

2026-03-10 #1
Information published.

References

CVE-2026-20967 System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20967
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss