CVE-2026-119991: Microsoft Configuration Manager Information Disclosure Vulnerability

Q: What access does an attacker need to exploit this issue?

The attacker does not need prior privileges or user interaction and can attempt exploitation over the network. The attack complexity is rated high.

Q: What is the expected impact if exploitation succeeds?

Successful exploitation can disclose information. The provided severity data indicates high confidentiality impact, with no integrity or availability impact.

Q: Which deployment is identified as affected?

Microsoft Configuration Manager version 2603 is identified as affected in the provided data.

Published Nov 10, 2026

Updated

Microsoft Configuration Manager Information Disclosure Vulnerability

Other sources

Weak authentication in Microsoft Configuration Manager allows an unauthorized attacker to disclose information over a network.

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Configuration Manager 2603<5.0.9146.1045

5.0.9146.1045

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.0.9146.1045

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:20 PM

Data Sourced

via MITRE·06:20 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker does not need prior privileges or user interaction and can attempt exploitation over the network. The attack complexity is rated high.

What is the expected impact if exploitation succeeds?

Successful exploitation can disclose information. The provided severity data indicates high confidentiality impact, with no integrity or availability impact.

Which deployment is identified as affected?

Microsoft Configuration Manager version 2603 is identified as affected in the provided data.

CVE-2026-119991: Microsoft Configuration Manager Information Disclosure Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Which deployment is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

Which deployment is identified as affected?