This vulnerability arises from improper neutralization of special characters in an SQL command used by Microsoft Configuration Manager, allowing an attacker with authorized access to inject malicious SQL statements. The result is a privilege escalation, granting the attacker elevated system rights over an adjacent network segment. The weakness is a classic SQL injection, identified as CWE-89.

Affected by the CNA are Microsoft Configuration Manager products including versions 2503, 2509, and 2603. Any system running these configurations and exposed to the relevant network interfaces is susceptible.

The CVSS score of 8 indicates a high severity. The EPSS score of 2% indicates a low probability of exploitation, and the absence of a KEV listing suggests no widespread exploitation at this time. Based on the description, it is inferred that the attack vector requires an authorized user with limited privileges to supply crafted input; thus the vulnerability does not allow arbitrary remote code execution from an unauthenticated source but can be leveraged to elevate privileges once some level of access is already present.