Critical SCCM Attack Chain Exposes Microsoft Environments to Remote Code Execution
Security researchers have uncovered a severe attack chain targeting Microsoft System Center Configuration Manager (SCCM), enabling threat actors to execute malicious code remotely on primary site servers potentially compromising an entire Windows-managed environment.
The vulnerabilities, reported by XM Cyber to Microsoft on May 23, 2026, exploit flaws in SCCM’s AdminService REST API, signature validation, and path traversal mechanisms. Notably, the attack can be initiated by any standard Active Directory domain user without requiring SCCM admin permissions, elevated privileges, or user interaction.
Key Vulnerabilities & Exploit Chain
-
Broken Authorization in Chunked Uploads
- SCCM’s AdminService API allows console extension packages (CAB files) to be uploaded via two endpoints.
- While one endpoint enforces role-based access control (RBAC), the chunked upload endpoint did not, enabling authenticated domain users to submit malicious CAB files.
-
Weak Signature Validation
- SCCM verified CAB file signatures but did not enforce that certificates belonged to Microsoft or the victim organization.
- It also skipped certificate revocation checks, allowing attackers to sign malicious packages with accepted certificates.
-
Path Traversal Flaw ("CabSlip")
- During CAB extraction, SCCM failed to block relative path sequences, enabling arbitrary file writes outside the intended directory.
- Attackers could overwrite adsource.dll, a secondary DLL loaded by the SMS Executive service (running as NT AUTHORITY\SYSTEM) without integrity checks.
Microsoft’s Response & Partial Fix
- Microsoft assigned CVE-2026-47301 to the broken authorization issue and released a patch on July 14, 2026, blocking standard domain users from exploiting the chunked upload endpoint.
- However, remaining flaws including signature validation and path traversal remain unpatched until ConfigMgr 2609, expected in October 2026.
- Users with Operations Administrator roles or custom roles with Create permissions on SMS_ConsoleExtensionData may still access parts of the attack chain.
Impact & Detection
A successful exploit grants attackers SYSTEM-level access to the SCCM primary site server, which manages software deployment, patching, OS installation, compliance monitoring, and device management across an organization.
Defenders are advised to:
- Monitor AdminService.log for DirectoryNotFoundException errors and HTTP 500 responses.
- Inspect unexpected CAB upload activity.
- Watch for changes to adsource.dll in the SCCM installation directory.
- Restrict access to the AdminService network port and review SCCM role assignments until a full fix is released.
Source: https://cybersecuritynews.com/microsoft-sccm-vulnerability/
Microsoft Security cybersecurity rating report: https://www.rankiteo.com/company/microsoft-security
"id": "MIC1786969594",
"linkid": "microsoft-security",
"type": "Vulnerability",
"date": "5/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Technology, Enterprise IT',
'location': 'Global',
'name': 'Microsoft System Center Configuration Manager '
'(SCCM) users',
'type': 'Software/IT Infrastructure'}],
'attack_vector': 'AdminService REST API, Chunked Upload Endpoint, Path '
'Traversal (CabSlip)',
'date_detected': '2026-05-23',
'description': 'Security researchers have uncovered a severe attack chain '
'targeting Microsoft System Center Configuration Manager '
'(SCCM), enabling threat actors to execute malicious code '
'remotely on primary site servers, potentially compromising an '
'entire Windows-managed environment. The vulnerabilities '
'exploit flaws in SCCM’s AdminService REST API, signature '
'validation, and path traversal mechanisms, allowing any '
'standard Active Directory domain user to initiate the attack '
'without requiring SCCM admin permissions, elevated '
'privileges, or user interaction.',
'impact': {'operational_impact': 'Compromise of software deployment, '
'patching, OS installation, compliance '
'monitoring, and device management',
'systems_affected': 'SCCM primary site servers, Windows-managed '
'environments'},
'investigation_status': 'Ongoing (partial patch released; full fix pending)',
'post_incident_analysis': {'corrective_actions': ['Patch CVE-2026-47301',
'Enforce strict signature '
'validation',
'Block relative path '
'sequences in CAB '
'extraction',
'Full fix in ConfigMgr '
'2609'],
'root_causes': ['Broken authorization in chunked '
'uploads',
'Weak signature validation',
'Path traversal flaw (CabSlip)']},
'recommendations': ['Apply Microsoft’s patch for CVE-2026-47301',
'Monitor SCCM logs for suspicious activity',
'Restrict access to AdminService network port',
'Review SCCM role assignments',
'Prepare for full patch in ConfigMgr 2609 (October 2026)'],
'references': [{'source': 'XM Cyber'}],
'response': {'containment_measures': ['Monitor AdminService.log for '
'DirectoryNotFoundException errors and '
'HTTP 500 responses',
'Inspect unexpected CAB upload activity',
'Watch for changes to adsource.dll in '
'the SCCM installation directory',
'Restrict access to the AdminService '
'network port',
'Review SCCM role assignments'],
'remediation_measures': 'Patch for CVE-2026-47301 released on '
'July 14, 2026; full fix expected in '
'ConfigMgr 2609 (October 2026)',
'third_party_assistance': 'XM Cyber'},
'title': 'Critical SCCM Attack Chain Exposes Microsoft Environments to Remote '
'Code Execution',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': ['CVE-2026-47301',
'Broken Authorization in Chunked Uploads',
'Weak Signature Validation',
'Path Traversal Flaw (CabSlip)']}