High · 8.0 CVE-2026-70049 EUVD-2026-99742GHSA-66c7-8967-j35q

Microsoft Configuration Manager Elevation of Privilege Vulnerability

Published Oct 13, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft Configuration Manager Product: Microsoft Configuration Manager 2509 Product: Microsoft Configuration Manager 2603

Description

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Microsoft Configuration Manager	1.0.0 – < 5.00.9135.1042	5.00.9135.1042
Microsoft	Microsoft Configuration Manager 2509	1.0.0 – < 5.00.9141.1041	5.00.9141.1041
Microsoft	Microsoft Configuration Manager 2603	1.0.0 – < 5.00.9146.1027	5.00.9146.1027

Advisories 3

WID-SEC-2026-3892 Microsoft Windows und Windows Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
WID-SEC-2026-3919 Microsoft SystemCenter (Defender und Configuration Manager): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
MSRC-CVE-2026-70049 Microsoft Configuration Manager Elevation of Privilege Vulnerability Microsoft Security Response Center · Oct 13, 2026

References

Microsoft Configuration Manager Elevation of Privilege Vulnerability vendor-advisory patch