Microsoft: CISA Issues Urgent Warning on Microsoft Configuration Manager SQL Injection Vulnerability Under Active Exploitation

Critical SQL Injection Flaw in Microsoft Configuration Manager Under Active Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-43468, a severe SQL injection vulnerability in Microsoft Configuration Manager, to its Known Exploited Vulnerabilities (KEV) catalogue, signaling an immediate threat to organizations using the enterprise management platform.

The flaw allows unauthenticated remote attackers to execute arbitrary commands on vulnerable servers by sending maliciously crafted requests. Exploitation does not require authentication, enabling threat actors to manipulate databases, extract sensitive data, alter system settings, or move laterally within compromised networks. Given Configuration Manager’s privileged access to thousands of endpoints, a successful attack could grant extensive control over corporate IT infrastructure.

CISA’s February 12, 2026 advisory mandates federal agencies to apply mitigations by March 5, 2026, per Binding Operational Directive 22-01. Cloud-based deployments must adhere to BOD 22-01 cloud service guidelines, while organizations unable to patch should discontinue use until fixes are available.

Microsoft has released security updates to address the vulnerability. While CISA has not confirmed ransomware-related exploitation, the flaw’s characteristics align with tactics used in initial access operations that often precede ransomware attacks. Security teams are advised to monitor for suspicious SQL queries, unusual database activity, or unauthorized command execution.

The active exploitation of this vulnerability underscores the urgency of patching, as enterprise management platforms remain prime targets for establishing persistent network footholds.

Source: https://gbhackers.com/cisa-issues-urgent-warning-on-microsoft-configuration-manager/

Microsoft Security Response Center cybersecurity rating report: https://www.rankiteo.com/company/microsoft-security-response-center

"id": "MIC1770972183",
"linkid": "microsoft-security-response-center",
"type": "Vulnerability",
"date": "2/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Organizations using Microsoft '
                                              'Configuration Manager',
                        'industry': 'Technology/IT Management',
                        'name': 'Microsoft Configuration Manager',
                        'type': 'Enterprise Management Platform'}],
 'attack_vector': 'Remote',
 'data_breach': {'data_exfiltration': 'Possible',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Sensitive data'},
 'date_publicly_disclosed': '2026-02-12',
 'description': 'CISA has added CVE-2024-43468, a severe SQL injection '
                'vulnerability in Microsoft Configuration Manager, to its '
                'Known Exploited Vulnerabilities (KEV) catalogue. The flaw '
                'allows unauthenticated remote attackers to execute arbitrary '
                'commands on vulnerable servers by sending maliciously crafted '
                'requests. Exploitation enables threat actors to manipulate '
                'databases, extract sensitive data, alter system settings, or '
                'move laterally within compromised networks. Given '
                'Configuration Manager’s privileged access to thousands of '
                'endpoints, a successful attack could grant extensive control '
                'over corporate IT infrastructure.',
 'impact': {'data_compromised': 'Sensitive data extraction possible',
            'operational_impact': 'Unauthorized command execution, lateral '
                                  'movement within networks',
            'systems_affected': 'Microsoft Configuration Manager servers'},
 'recommendations': 'Patch immediately, monitor for suspicious activity, '
                    'discontinue use if unable to patch',
 'references': [{'source': 'CISA Advisory'}],
 'regulatory_compliance': {'regulatory_notifications': 'CISA Binding '
                                                       'Operational Directive '
                                                       '22-01 (federal '
                                                       'agencies must apply '
                                                       'mitigations by March '
                                                       '5, 2026)'},
 'response': {'containment_measures': 'Discontinue use until patches are '
                                      'applied (for organizations unable to '
                                      'patch)',
              'enhanced_monitoring': 'Monitor for suspicious SQL queries, '
                                     'unusual database activity, or '
                                     'unauthorized command execution',
              'remediation_measures': 'Apply Microsoft security updates'},
 'stakeholder_advisories': 'Federal agencies must apply mitigations by March '
                           '5, 2026 (BOD 22-01)',
 'title': 'Critical SQL Injection Flaw in Microsoft Configuration Manager '
          'Under Active Exploitation',
 'type': 'SQL Injection',
 'vulnerability_exploited': 'CVE-2024-43468'}