Description
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
Published: 2026-10-13
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Elevation of Privilege
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is due to improper neutralization of special elements in a SQL command, creating an SQL injection flaw in Microsoft Configuration Manager. An attacker who already has authorized access to the system can inject crafted input that bypasses authentication checks or modifies privileges, allowing them to elevate their access rights over the network.

Affected Systems

Microsoft Configuration Manager versions 2503, 2509, and 2603 are vulnerable. These are the current major releases of the product at the time of the advisory.

Risk and Exploitability

The CVSS score of 8.8 signals a high‑severity flaw. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. An authorized user can exploit the injection remotely through the Configuration Manager service to gain elevated privileges, which can then be used to compromise the entire Configuration Manager installation and potentially other network resources.

Generated by OpenCVE AI on October 14, 2026 at 09:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Microsoft Security Update for Configuration Manager 2509 and 2603 as released by Microsoft
  • Restrict database and web service access to only the minimum user accounts required for normal operation
  • Review and enforce input validation and use parameterized queries for all database interactions in Configuration Manager

Generated by OpenCVE AI on October 14, 2026 at 09:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:microsoft:configuration_manager_2503:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:configuration_manager_2509:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:configuration_manager_2603:-:*:*:*:*:*:*:*

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
Title Configuration Manager Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft configuration Manager 2503
Microsoft configuration Manager 2509
Microsoft configuration Manager 2603
Weaknesses CWE-89
CPEs cpe:2.3:a:microsoft:configuration_manager_2503:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:configuration_manager_2509:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:configuration_manager_2603:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft configuration Manager 2503
Microsoft configuration Manager 2509
Microsoft configuration Manager 2603
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Configuration Manager 2503 Configuration Manager 2509 Configuration Manager 2603
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:10:27.158Z

Reserved: 2026-09-09T21:47:30.202Z

Link: CVE-2026-88075

cve-icon Vulnrichment

Updated: 2026-10-13T19:59:34.307Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T19:21:26.270

Modified: 2026-10-16T15:52:27.540

Link: CVE-2026-88075

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-14T10:00:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')