Description
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft Configuration Manager | 1.0.0 – < 5.00.9135.1040 | 5.00.9135.1040 |
| Microsoft | Microsoft Configuration Manager 2509 | 1.0.0 – < 5.00.9141.1039 | 5.00.9141.1039 |
| Microsoft | Microsoft Configuration Manager 2603 | 1.0.0 – < 5.00.9146.1026 | 5.00.9146.1026 |
Advisories 4
- WID-SEC-2026-3892 Microsoft Windows und Windows Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- WID-SEC-2026-3919 Microsoft SystemCenter (Defender und Configuration Manager): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026
- NCSC-2026-0425 Kwetsbaarheden verholpen in Microsoft System Center NCSC-NL (Netherlands) · Oct 13, 2026
- MSRC-CVE-2026-88075 Configuration Manager Elevation of Privilege Vulnerability Microsoft Security Response Center · Oct 13, 2026
References
- Configuration Manager Elevation of Privilege Vulnerability vendor-advisory patch