Critical SCCM Exploit Chain Grants SYSTEM Privileges via CVE-2026-47301
Security researcher Omri Baso has disclosed a proof-of-concept (PoC) exploit for Microsoft Configuration Manager (SCCM), formerly System Center Configuration Manager, demonstrating how an authenticated domain user could escalate privileges to SYSTEM on a vulnerable Primary Site Server. The flaw, tracked as CVE-2026-47301, is an exploit chain combining multiple vulnerabilities rather than a single defect.
The attack leverages broken access control, path traversal in CAB archive extraction, certificate verification bypass, and DLL hijacking to execute code with SCCM’s high-privilege service context. A specially crafted CAB file can write malicious DLLs to the bin\X64 directory of the SCCM installation regardless of the deployment path bypassing assumptions that non-default directories offer protection.
The exploit targets adsource.dll, loaded by the SMS_EXECUTIVE service, which runs with SYSTEM privileges. Baso’s PoC includes a proxy-DLL mechanism to maintain normal service functionality while executing malicious code. Successful exploitation grants attackers full control over the compromised server, enabling actions such as:
- Modifying the RID 500 local Administrator account (as demonstrated in the PoC)
- Deploying remote-access tools
- Manipulating SCCM packages
- Harvesting credentials
- Disabling security controls
- Distributing malicious content to managed endpoints
The PoC also reveals that low-privilege domain accounts can identify potential Primary Site Server targets by analyzing Active Directory’s System Management container, where SCCM servers typically hold elevated permissions. While server names may not be directly exposed, attackers can infer targets by examining machine account permissions.
The repository includes a compiled release and a signed CAB file, increasing the urgency for organizations to assess their exposure. Microsoft has released an advisory with security updates and mitigations, though defenders are advised to:
- Restrict access to SCCM infrastructure
- Audit modifications in SCCM binary directories
- Monitor for unexpected DLL loads by SMS_EXECUTIVE
- Inspect Active Directory permissions on the System Management container
Primary Site Servers are high-value targets in enterprise environments, managing software deployment, endpoint configurations, and OS deployment workflows, making this exploit particularly critical for lateral movement and infrastructure compromise.
Source: https://gbhackers.com/poc-exploit-released-for-microsoft-sccm-vulnerability/
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security-response-center
"id": "mic1787034406",
"linkid": "microsoft-security-response-center",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'type': 'Enterprise Organizations'}],
'attack_vector': 'Exploit Chain (Broken Access Control, Path Traversal, '
'Certificate Verification Bypass, DLL Hijacking)',
'data_breach': {'file_types_exposed': 'DLL files (adsource.dll)',
'personally_identifiable_information': 'Potential '
'(credentials, RID 500 '
'local Administrator '
'account)',
'sensitivity_of_data': 'Credentials, SCCM-managed '
'configurations, endpoint data'},
'description': 'Security researcher Omri Baso disclosed a proof-of-concept '
'(PoC) exploit for Microsoft Configuration Manager (SCCM), '
'demonstrating how an authenticated domain user could escalate '
'privileges to SYSTEM on a vulnerable Primary Site Server. The '
'flaw, tracked as CVE-2026-47301, is an exploit chain '
'combining broken access control, path traversal in CAB '
'archive extraction, certificate verification bypass, and DLL '
'hijacking to execute code with SCCM’s high-privilege service '
'context.',
'impact': {'identity_theft_risk': 'High (credential harvesting, manipulation '
'of sensitive accounts)',
'operational_impact': 'Full control over compromised server, '
'enabling modification of local '
'Administrator accounts, deployment of '
'remote-access tools, manipulation of SCCM '
'packages, credential harvesting, disabling '
'security controls, and distribution of '
'malicious content to managed endpoints',
'systems_affected': 'Primary Site Servers running Microsoft '
'Configuration Manager (SCCM)'},
'initial_access_broker': {'high_value_targets': 'Primary Site Servers (SCCM)'},
'post_incident_analysis': {'corrective_actions': 'Apply security updates, '
'restrict access, audit '
'modifications, monitor DLL '
'loads, inspect AD '
'permissions',
'root_causes': 'Broken access control, path '
'traversal in CAB archive '
'extraction, certificate '
'verification bypass, DLL '
'hijacking'},
'recommendations': ['Apply Microsoft security updates and mitigations',
'Restrict access to SCCM infrastructure',
'Audit modifications in SCCM binary directories',
'Monitor for unexpected DLL loads by SMS_EXECUTIVE',
'Inspect Active Directory permissions on the System '
'Management container'],
'references': [{'source': 'Security Researcher Omri Baso'}],
'response': {'containment_measures': ['Restrict access to SCCM infrastructure',
'Audit modifications in SCCM binary '
'directories',
'Monitor for unexpected DLL loads by '
'SMS_EXECUTIVE',
'Inspect Active Directory permissions '
'on the System Management container'],
'enhanced_monitoring': 'Monitor for unexpected DLL loads by '
'SMS_EXECUTIVE',
'remediation_measures': 'Apply Microsoft security updates and '
'mitigations'},
'title': 'Critical SCCM Exploit Chain Grants SYSTEM Privileges via '
'CVE-2026-47301',
'type': 'Privilege Escalation',
'vulnerability_exploited': 'CVE-2026-47301'}