Improper access control in Microsoft Configuration Manager

CVE-2026-47301 is a broken authorization check in Microsoft Configuration Manager's AdminService REST API. SCCM exposes two upload endpoints for console extensions: one enforces role-based access control, the other (the chunked-upload path) does not. Any authenticated Active Directory domain user — zero SCCM roles required — can submit a malicious CAB archive to the unprotected endpoint. This is link 1 in a four-link chain demonstrated by XM Cyber researcher Omri Baso: authorization bypass → CabSlip path traversal → weak code-signing validation (defeated with a $58 Certum certificate) → unsigned DLL load in the SMS Executive service. The chain ends in NT AUTHORITY\SYSTEM on the primary site server, which has push-execution authority over every managed Windows client. Affected versions include ConfigMgr current branch 2503, 2509, and 2603.

Microsoft rated this 8.8 HIGH — and that is too conservative. The vendor score treats the vulnerability as an isolated elevation-of-privilege bug. It does not account for the fact that the affected component is an endpoint fleet management platform: SYSTEM on the site server is not a single-host event, it is *fleet compromise*. The remaining three chain links (CabSlip, signature bypass, DLL sideload) are unpatched until ConfigMgr 2609 in October 2026, meaning the full chain is currently viable. Any organization running an unpatched SCCM site server with domain-user-reachable AdminService is one HTTP POST away from losing control of every managed endpoint.

Why this verdict

• Authorization bypass is zero-friction for insiders. Any authenticated AD domain user — including a compromised workstation, a contractor account, or a helpdesk operator — can reach the vulnerable endpoint. No SCCM roles, no special group memberships, no user interaction required. The PR:L rating understates how trivially this prerequisite is met in enterprise environments.
• Role multiplier: SCCM site server is a fleet-management platform; chain ends in fleet compromise. The affected component is not a workstation utility or a line-of-business app. Every SCCM installation is, by definition, a high-value asset: the site server holds push-execution authority over every managed Windows endpoint. SYSTEM on the site server = arbitrary code execution on the entire managed fleet. This is analogous to compromising a domain controller in blast-radius terms. ≥95% of ConfigMgr installs occupy the high-value role — the product exists solely to manage fleets. Verdict floor is CRITICAL.
• Three of four chain links are unpatched. The July 2026 patch closes only the entry point (CVE-2026-47301). CabSlip path traversal, weak certificate validation, and unsigned DLL loading remain exploitable until ConfigMgr 2609 in October. Even after patching CVE-2026-47301, the residual attack surface means any alternative entry point discovered in the interim re-enables the full chain.
• Low EPSS and no KEV do not override blast radius. EPSS of 0.00537 reflects low current exploitation probability, which provides some time cushion. However, the chain is fully documented in public media coverage, and the $58 certificate trick dramatically lowers the barrier to reproduction. The absence of a public PoC repo is a temporary condition, not a structural defense.

Why not higher?

A 9.2 rather than 10.0 because the chain requires four links (increasing complexity relative to a single-step RCE), the entry point requires authenticated domain access (not unauthenticated), and there is no confirmed in-the-wild exploitation or public PoC as of this assessment. The July patch for CVE-2026-47301 does close the known entry point, reducing immediate risk for organizations that have applied it.

Why not lower?

The affected component is canonically a fleet-management platform where ≥95% of installations occupy the high-value role by definition. The chain ends in SYSTEM on the site server with push-execution authority over the entire managed fleet — this is fleet-scale blast radius, not single-host. Requiring only any AD domain user credential is not meaningful friction in post-initial-access scenarios. Three of four chain links remain unpatched, and the technique is publicly described in enough detail for skilled adversaries to reproduce. Downgrading below CRITICAL would require evidence that the AdminService endpoint is unreachable from the general domain-user population, which contradicts its default configuration.

1. Restrict AdminService network access immediately — Deploy firewall rules or NSG policies limiting TCP 443 on the SCCM site server to designated administrative subnets only. This eliminates the most accessible attack surface by preventing arbitrary domain users from reaching the vulnerable endpoint. Deploy within 3 days per noisgate mitigation SLA for CRITICAL findings.
2. Apply KB 38232642 (CVE-2026-47301 fix) — Install the July 2026 hotfix via ConfigMgr 2509 Update Rollup 2 (KB 37864969) to close the authorization bypass entry point. This does NOT fix links 2–4 but eliminates the known path to trigger them. Deploy within 3 days.
3. Enable WDAC on the site server with a Microsoft-only signing policy — Windows Defender Application Control in enforced mode with a policy restricting DLL loads to Microsoft-signed binaries would block the unsigned/third-party-signed DLL sideload (link 4), breaking the chain even if links 1–3 are exploited. This is the strongest compensating control for the unpatched links. Deploy within 3 days.
4. Deploy file integrity monitoring on the ConfigMgr install directory — Configure FIM (via Defender for Endpoint, OSSEC, Tripwire, or equivalent) to alert on any file creation or modification in the SCCM installation directory, particularly adsource.dll. This provides detection coverage for link 3 (CabSlip file write).
5. Audit AdminService.log for anomalous upload activity — Create SIEM detection rules for extension-upload requests from non-admin accounts and for System.IO.DirectoryNotFoundException + HTTP 500 patterns in AdminService.log. Forward these logs to your SIEM immediately if not already collected.

Run this script on the SCCM primary site server as a local administrator. It checks whether the CVE-2026-47301 hotfix (KB 38232642) has been applied by inspecting the ConfigMgr console version. Example: .\Check-CVE202647301.ps1

#Requires -RunAsAdministrator
# Check-CVE202647301.ps1
# Verifies whether KB 38232642 (CVE-2026-47301 fix) is applied
# Run on the SCCM primary site server as local admin
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

try {
    # Method 1: Check console version via WMI
    $siteStatus = Get-WmiObject -Namespace 'root\SMS' -Class 'SMS_ProviderLocation' -ErrorAction SilentlyContinue
    if (-not $siteStatus) {
        Write-Host 'UNKNOWN - Unable to query SMS WMI namespace. Is this an SCCM site server?'
        exit 2
    }

    $siteCode = ($siteStatus | Select-Object -First 1).SiteCode
    $namespace = "root\SMS\site_$siteCode"

    # Check installed hotfixes
    $hotfix = Get-WmiObject -Namespace $namespace -Query "SELECT * FROM SMS_CM_UpdatePackages WHERE Name LIKE '%38232642%' OR Name LIKE '%37864969%'" -ErrorAction SilentlyContinue

    if ($hotfix) {
        $installed = $hotfix | Where-Object { $_.State -eq 196612 }  # State 196612 = Installed
        if ($installed) {
            Write-Host 'PATCHED - KB 38232642 / KB 37864969 (CVE-2026-47301 fix) is installed.'
            exit 0
        } else {
            Write-Host "VULNERABLE - Hotfix found but state is: $($hotfix.State). Not fully installed."
            exit 1
        }
    }

    # Method 2: Fallback - check console DLL version
    $consolePath = Join-Path $env:SMS_ADMIN_UI_PATH '..\Microsoft.ConfigurationManagement.exe'
    if (Test-Path $consolePath) {
        $ver = (Get-Item $consolePath).VersionInfo.FileVersion
        $parsed = [version]$ver
        # Fixed version: 5.2509.1036.1700 or later
        $fixedVer = [version]'5.2509.1036.1700'
        if ($parsed -ge $fixedVer) {
            Write-Host "PATCHED - Console version $ver meets or exceeds fixed version $fixedVer."
            exit 0
        } else {
            Write-Host "VULNERABLE - Console version $ver is below fixed version $fixedVer."
            exit 1
        }
    }

    Write-Host 'UNKNOWN - Could not determine patch status via WMI or console version.'
    exit 2

} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}

Sources

1. Microsoft KB 37864969 – ConfigMgr 2509 Update Rollup 2
2. CSO Online – It took $58 to break Microsoft's SCCM
3. SentinelOne Vulnerability Database – CVE-2026-47301
4. CrowdStrike – July 2026 Patch Tuesday Analysis
5. Microsoft KB 38232642 – Security update for console extensions
6. NVD – CVE-2026-47301
7. TheWindowsUpdate – CVE-2026-47301 Advisory
8. Qualys – July 2026 Patch Tuesday Review