Unpatched Vulnerabilities in Microsoft's ConfigMgr Expose Enterprise Fleet
A recent demonstration by XM Cyber has shown that an ordinary Active Directory domain user can compromise Microsoft's Configuration Manager (SCCM) and gain full SYSTEM-level control over a primary site server, as well as command every endpoint it manages. This is possible due to four distinct vulnerabilities in SCCM, which have not been fully addressed by Microsoft.
The first vulnerability, tracked as CVE-2026-47301, was patched in July, but the other three remain unaddressed until ConfigMgr 2609, planned for October. The attack requires network access to the SCCM environment and valid Active Directory credentials. It starts with a chunked-upload authorization gap in the AdminService REST API, which allows any authenticated domain user to submit a malicious CAB archive to the server without holding a single SCCM role.
Once the CAB archive reaches the server, a path-traversal flaw named CabSlip allows files inside it to escape the intended extraction directory and land anywhere the service process can write. This is a well-documented vulnerability class that has been present in ConfigMgr for years.
The final step involves using a commercially purchased code-signing certificate to bypass SCCM's signature validation, which only checks structural correctness and certificate expiration dates. For his research, XM Cyber researcher Omri Baso purchased a Certum Open Source Developer Certificate for approximately $58. Revocation is disabled, so even a compromised certificate remains valid.
The four-link chain allows an attacker to push arbitrary software, disable endpoint protection agents, and pivot laterally across a network with near-zero friction, making SCCM access an amplifier in ransomware and nation-state intrusion scenarios.