Microsoft Configuration Manager: SQL injection leading to privilege escalation
Summary
A SQL injection flaw in Microsoft Configuration Manager (ConfigMgr) allows an authenticated attacker with a low-privileged account to elevate privileges. The attack requires adjacent network access, not internet access, and high attack complexity. ConfigMgr holds privileged control over many endpoints, so a successful attack could affect a large part of the managed environment. The CVSS 3.1 base score is 8.0; NVD analysis was still pending at the time of writing.
Affected
- Microsoft Configuration Manager: 1.0.0 to before 5.00.9135.1042
- Configuration Manager 2509: 1.0.0 to before 5.00.9141.1041
- Configuration Manager 2603: 1.0.0 to before 5.00.9146.1027
- Configuration Manager 2503: listed as affected by third-party sources, exact range unknown
Fixed in
- Security update KB39398030 (Microsoft Learn) addresses CVE-2026-70049.
- Version 2603: apply KB39398030 directly.
- Versions 2509 and 2503: apply KB39398030 after the required update rollups are installed.
- Exact fixed build for 2503: Unknown.
- Prerequisite rollup list on the vendor page was not fully readable; verify before deployment.
Workaround
Unknown. No vendor-published workaround is known; patching is the stated fix.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC assessment in the CVE record: exploitation none, not automatable, total technical impact.
- Vector includes E:P (proof of concept), a Microsoft-supplied temporal metric; no public PoC or exploit write-up was found.
- EPSS about 0.023.
Our recommendation
- Inventory all ConfigMgr versions (2503, 2509, 2603 and older) and identify the site servers and their SQL databases.
- Apply KB39398030 with its prerequisite rollups, or the equivalent MSRC-listed update for your branch; confirm the 2503 build with Microsoft.
- Confirm that no ConfigMgr site system (management point, distribution point, SMS Provider) is reachable from the internet.
- Restrict ConfigMgr console rights and low-privileged accounts; review admin and SQL logs for unexpected logins or new SQL logins.
- Recheck NVD and CISA KEV for updates, as NVD analysis was pending.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-70049 msrc.microsoft.com
- Microsoft Learn: Security update KB39398030 for ConfigMgr 2603 learn.microsoft.com
- Vulners: NVD record CVE-2026-70049 vulners.com
- Vulners: CVEList record CVE-2026-70049 vulners.com
- Strix: CVE-2026-70049 www.strix.ai
- OpenCVE: CVE-2026-70049 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:25.
Original description (NVD)
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.