Microsoft Configuration Manager: SQL injection with privilege escalation

Summary

Microsoft Configuration Manager (ConfigMgr) contains an SQL injection flaw (CWE-89) that allows privilege escalation. An attacker with a valid low-privilege account who can reach the affected site over the network can inject SQL commands and gain higher privileges. No user interaction is required. Because ConfigMgr holds privileged access to managed endpoints, a successful attack could affect many devices.

Affected

• Microsoft Configuration Manager (base line): before 5.00.9135.1040
• Microsoft Configuration Manager 2509: before 5.00.9141.1039
• Microsoft Configuration Manager 2603: before 5.00.9146.1026
• Microsoft Configuration Manager 2503: affected range not listed in the CNA data; check the MSRC advisory

Fixed in

• Configuration Manager 2503: build unknown; take the KB link from the MSRC advisory
• Configuration Manager 2603: KB38982839 (Security update for the SMS Provider and administration service)
• Configuration Manager 2509 and base line: fixed builds as listed in the table above; confirm on the MSRC advisory

Workaround

No vendor workaround known.

• General hardening only (not vendor-specific): enable SQL injection protection in IIS and use least-privilege database accounts.

Exploitation

• CISA SSVC (Vulnrichment): Exploitation none, Automatable no, Technical Impact total
• Not listed in CISA KEV at the time of the aggregator data
• No public proof of concept known

Our recommendation

• Identify all ConfigMgr 2503, 2509 and 2603 site servers, console and SMS Provider hosts
• Apply the fix for your branch from the MSRC advisory (2603: KB38982839)
• Confirm that the site is not reachable from the internet
• Review which accounts can authenticate to the site and remove unneeded access
• Check SQL logs for anomalies

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88075 msrc.microsoft.com
• Microsoft Learn: KB38982839 (2603 hotfix) learn.microsoft.com
• OpenCVE: CVE-2026-88075 app.opencve.io
• GBHackers: CISA warning on Microsoft Configuration Manager gbhackers.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:15.