Microsoft SCCM Vulnerability Exposes Windows Environments to Remote Attacks

A critical vulnerability has been discovered in Microsoft System Center Configuration Manager (SCCM), also known as ConfigMgr. Researchers have identified an attack chain that could allow an attacker to execute malicious code remotely on an SCCM primary site server, potentially taking control of an organization's managed Windows environment.

The flaws, reported by XM Cyber to Microsoft on May 23, involve several weaknesses in the SCCM system. The first issue is a broken authorization check in the AdminService REST API, which allows authenticated domain users to submit specially crafted CAB files to the server without proper permission.

Additionally, SCCM does not enforce valid embedded signatures on CAB archives and skips certificate revocation checks. This makes it possible for an attacker to use a certificate that SCCM accepts to sign malicious extension packages.

The final step in the attack chain abuses DLL loading behavior in the SMS Executive service, which runs with NT AUTHORITY/sys privileges. An attacker can overwrite the adsource.dll library through a path traversal flaw and execute malicious code as SYSTEM when SCCM loads the library.

Microsoft has released a fix for one of the issues, but researchers say the remaining weaknesses are still unpatched and will be addressed in ConfigMgr 2609, expected in October 2026. In the meantime, defenders should monitor AdminService.log for specific errors and inspect unexpected CAB upload activity.