Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited. Customer action: Required.
Details
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by sending specially crafted requests to the affected service interface, allowing them to upload content without the required permissions. By doing so, an authenticated attacker could leverage this unauthorized access to introduce malicious or unintended content into the system, leading to elevated capabilities beyond their intended level.
Security updates
5.0.9141.1030 — https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2509/36949461
5.0.9146.1021 — https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2603/38232642
Vulnerabilities 1
-
High 8.8CVE-2026-47301 Public exploit
Configuration Manager Elevation of Privilege Vulnerability
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
Revision history
-
#2
Corrected Build Number in the Security Updates table. This is an informational change only.
-
#1
Information published.
References
-
CVE-2026-47301 Configuration Manager Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47301
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss