Microsoft SCCM Vulnerability

Overview

Security researchers have disclosed a serious attack chain affecting Microsoft System Center Configuration Manager (SCCM). The flaws could allow attackers to execute malicious code remotely on an SCCM primary site server, potentially compromising an organization’s entire managed Windows environment. Alarmingly, the chain can be initiated by a standard Active Directory domain user—no SCCM admin rights, elevated privileges, or user interaction required.

Vulnerability Chain Breakdown

• CVE‑2026‑47301 – Broken authorization in the AdminService REST API.
  • SCCM supports uploading console extension packages via CAB archives.
  • One endpoint enforced role‑based access control, but the chunked upload endpoint did not, allowing authenticated domain users to upload crafted CAB files.
• Signature validation weakness – SCCM checked for valid signatures but did not enforce that certificates belonged to Microsoft or the victim organization.
  • No revocation checks performed.
  • Attackers could sign malicious extension packages with accepted certificates.
• CabSlip path traversal – During CAB extraction, SCCM failed to block relative path sequences.
  • Crafted archives could write files outside the intended folder, enabling arbitrary file writes on the server.
• DLL hijacking in SMS Executive – SMS Executive service runs with NT AUTHORITY\SYSTEM privileges.
  • While validating a primary DLL, it loads a secondary DLL (adsource.dll) without integrity checks.
  • Attackers could overwrite this DLL via path traversal, leading to SYSTEM‑level code execution.

Exploit Path

1. Upload malicious CAB via chunked endpoint.
2. Sign package with a certificate SCCM accepts.
3. Abuse CabSlip to write outside extraction folder.
4. Overwrite adsource.dll.
5. Achieve SYSTEM‑level execution when SMS Executive loads the DLL.

Security Implications

• Remote code execution: Attackers gain SYSTEM privileges on SCCM primary site servers.
• Enterprise compromise: SCCM controls software deployment, patching, OS installation, compliance, and device management—making it a high‑value target.
• Unpatched weaknesses: Microsoft fixed CVE‑2026‑47301 in July 2026, but other flaws remain unpatched until ConfigMgr 2609 (October 2026).

Defensive Guidance

Organizations should:

• Update SCCM: Apply Microsoft’s July patch immediately.
• Restrict AdminService access: Limit exposure of the AdminService network port.
• Monitor logs: Watch AdminService.log for DirectoryNotFoundException errors followed by HTTP 500 responses.
• Inspect CAB uploads: Investigate unexpected CAB file activity.
• Check DLL integrity: Monitor for changes to adsource.dll in the SCCM installation directory.
• Review role assignments: Restrict Operations Administrator and custom roles with Create permissions on SMS_ConsoleExtensionData.

Expert in the Cloud Insight

This SCCM attack chain demonstrates how small gaps in authorization and validation can be chained into full SYSTEM compromise. With SCCM acting as the nerve center of enterprise IT, attackers exploiting these flaws could seize control of thousands of managed endpoints. The lesson is clear: patch quickly, restrict access, and monitor aggressively until Microsoft delivers a complete fix in ConfigMgr 2609.