Microsoft's SCCM Patch Falls Short, Leaving RCE Chain Open

A security researcher has discovered a chain of four remote code execution (RCE) bugs in Microsoft's Configuration Manager (SCCM/ConfigMgr), allowing an ordinary Active Directory user to seize SYSTEM control of a Primary Site Server and every client it manages. The researcher, Omri Baso, reported the issue to Microsoft on May 23rd, 2026.

The chain is initiated by CVE-2026-47301, a missing role-based access control (RBAC) check in the SCCM AdminService REST API. SentinelOne's advisory rates it at CVSS 8.8 under CWE-284, improper access control; Microsoft rates it as an elevation-of-privilege flaw.

The chain runs through three additional flaws: a path-traversal bug named CabSlip, which allows files inside the CAB to escape the extraction folder and write anywhere the service can reach; weak Authenticode validation that accepts any non-revoked code-signing certificate; and an insecurely loaded DLL adsource.dll.

Microsoft has patched only one link in the chain, CVE-2026-47301, with hotfix KB38232642. The update requires no computer restart or site reset. However, the full path to code execution remains open until a later release, ConfigMgr 2609, expected in October 2026.