CVE-2026-70049: Microsoft Configuration Manager Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
Other sources
Microsoft Configuration Manager Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.00.9135.1042 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.00.9141.1041 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.00.9146.1027
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Organizations running Microsoft Configuration Manager, including the listed 2503, 2509, and 2603 releases, may be affected. Exploitation is limited to an adjacent-network attack path rather than an arbitrary Internet-based attacker.
What access does an attacker need to exploit it?
The attacker must already be authorized and have low privileges. No user interaction is required, but the attacker must be positioned on an adjacent network and overcome high attack complexity.
What is the potential impact of successful exploitation?
A successful attacker can elevate privileges and may gain high-impact confidentiality, integrity, and availability access. The scope can extend beyond the initially affected security authority.