CVE-2026-88075: Configuration Manager Elevation of Privilege Vulnerability
Configuration Manager Elevation of Privilege Vulnerability
Other sources
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.00.9135.1040 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.00.9146.1026 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.00.9141.1039
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized and have network access to Microsoft Configuration Manager. The issue is not described as exploitable by an unauthenticated attacker.
What is the potential impact of successful exploitation?
A successful SQL injection attack can allow the authorized attacker to elevate privileges. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.
Which Configuration Manager releases are identified as affected?
The affected software list includes Microsoft Configuration Manager 2503, 2603, and 2509, as well as a general Microsoft Configuration Manager entry.