SCCM PoC Exploit Exposes Severe Vulnerability, Allows System-Level Code Execution

A recently discovered proof-of-concept (PoC) exploit for Microsoft's Configuration Manager (SCCM) has highlighted a severe vulnerability that could enable an attacker to escalate privileges to SYSTEM on a Primary Site Server.

The issue, tracked as CVE-2026-47301, was reported by security researcher Omri Baso and involves a complex exploit chain that combines several vulnerabilities, including broken access control, CAB archive extraction path traversal, certificate verification bypass, and DLL hijacking.

The PoC exploit demonstrates how an authenticated domain user could write files outside the intended extraction location via a traversal sequence, allowing the attacker to place DLL files in the Configuration Manager installation's binolder. This technique is path-independent, making it difficult for organizations to protect themselves by choosing non-default deployment paths.