- Status: Partially Patched / Mitigation Available
- Affected Versions: All supported versions of Microsoft System Center Configuration Manager (SCCM)
- Reference: CVE-2026-47301
Enterprises rely on Microsoft SCCM to deploy operating systems, manage patches, and enforce compliance across massive Windows fleets. But researchers at XM Cyber have demonstrated a critical SCCM vulnerability that turns that trust into a liability. By chaining four distinct flaws, an attacker with only a standard domain account can escalate privileges to NT AUTHORITY\SYSTEM on the primary site server.
The attack begins at the AdminService API, which handles extension uploads. While the standard upload endpoint verifies user permissions, the chunked-upload counterpart does not. This oversight allows an authenticated Active Directory user to push a malicious CAB archive directly to the server without administrative rights. Microsoft addressed this specific authorization gap in July, tracked as CVE-2026-47301, but the underlying architecture still harbors exploitable weaknesses.
Once the archive lands on the server, the second flaw kicks in. XM Cyber researchers dubbed this path-traversal bug “CabSlip.” It lets files break out of the intended temporary extraction directory and write to arbitrary locations on the filesystem. From there, the attacker targets adsource.dll, a secondary library loaded by the SYSTEM-level SMS Executive service. Because that service skips its own signature verification, dropping a malicious version of the DLL grants immediate code execution at the highest privilege level.
The $58 Certificate Loophole
What makes this chain particularly dangerous is how it bypasses trust boundaries. SCCM’s signature validation only checks that a certificate is structurally valid and not expired. Revocation checks are disabled, and the system does not verify that the signing certificate actually belongs to Microsoft or the target organization.
This means attackers do not need a stolen enterprise certificate or a zero-day exploit kit. XM Cyber researcher Omri Baso demonstrated the full chain using a Certum Open Source Developer Certificate purchased for roughly $58. The same technique can also abuse certificates leaked on underground forums. For defenders, this lowers the barrier to entry significantly, turning a complex privilege escalation into a commodity attack.
Microsoft’s July update blocked the initial chunked-upload route for standard domain users, but the chain remains reachable through another path. Users assigned the built-in Operations Administrator role, or a custom role with Create permission on SMS_ConsoleExtensionData, can still trigger the same sequence. XM Cyber notes that organizations are unlikely to be exposed through this route because the Operations Administrator role already carries heavy privileges, but the theoretical risk remains for environments with overly broad role assignments.
What This Means for You
If you manage an SCCM environment, this research highlights a gap between Microsoft’s patching cadence and the actual attack surface. The full remediation for the remaining chain links is not expected until ConfigMgr 2609, planned for release in October. Until then, relying solely on Microsoft’s updates leaves your primary site server exposed to multi-stage exploitation.
For IT administrators, the immediate priority is defense in depth. Network segmentation around the AdminService API should be enforced to block unauthorized external access. You should also audit your Role-Based Access Control (RBAC) assignments, specifically looking for accounts that hold the Operations Administrator role or equivalent Create permissions on console extension data. If those permissions are not strictly necessary, revoke them immediately.
How to Detect and Mitigate the Attack
Detection relies on monitoring specific system behaviors that indicate the chain is being triggered. XM Cyber recommends watching the Site Server’s AdminService.log for a System.IO.DirectoryNotFoundException followed immediately by an HTTP 500 response. This pattern strongly suggests the path traversal component of the attack has been activated.
Additionally, file integrity monitoring around the Configuration Manager installation directory is crucial. Unexpected modifications to adsource.dll should trigger an immediate incident response workflow. Because the SMS Executive service loads this library without its own signature check, any unauthorized replacement is a clear indicator of compromise.
While ConfigMgr 2609 approaches, combining network restrictions, strict RBAC auditing, and active log monitoring will close the gap until Microsoft ships the comprehensive fix. Until then, treat the AdminService API as a high-value target and enforce zero-trust principles around extension uploads.
Source: Computerworld
Over to you: Are you relying on the upcoming ConfigMgr 2609 update, or have you already implemented network restrictions for the AdminService API?
You may also like
Microsoft Unifies Consumer and Microsoft 365 Copilot Apps Into Single Client
Microsoft Begins Rolling Out the Unified Copilot App, Merging Consumer and M365 Experiences
Xbox August Update Rolls Out With Major Cloud Save and Game Hub Upgrades
Xbox August Update Expands Xbox 360 Support and Wishlist Limits
