Security researchers have disclosed a serious attack chain affecting Microsoft System Center Configuration Manager (SCCM), also known as Configuration Manager.

The vulnerabilities could allow an attacker to execute malicious code remotely on an SCCM primary site server, potentially gaining control of an organization's managed Windows environment.

The attack is particularly concerning because a standard Active Directory domain user could initiate the original attack chain without SCCM administrative permissions, elevated Windows privileges, or user interaction.

A successful compromise targets the SCCM primary site server, a critical infrastructure component responsible for software deployment, patching, operating system installation, compliance monitoring, and device management.

Microsoft SCCM Vulnerability

XM Cyber reported the vulnerabilities to Microsoft on May 23, 2026. Microsoft assigned CVE-2026-47301 to the broken authorization issue and released a fix on July 14, 2026.

However, researchers said the remaining weaknesses in the attack chain are still unpatched. Microsoft plans to address them in Configuration Manager 2609, expected in October 2026.

Alt text

The attack chain combines multiple weaknesses involving the SCCM AdminService API, signature validation, archive extraction, and DLL loading.

1. AdminService Authorization Bypass

The first issue affects SCCM's AdminService REST API.

SCCM supports uploading console extension packages through CAB archives. While one upload endpoint properly checks whether the requesting user has the required role-based access control permissions, researchers found that a separate chunked upload endpoint did not perform the same authorization check.

As a result, an authenticated domain user could submit specially crafted CAB files to the SCCM server without having SCCM administrative privileges.

2. Weak Signature Validation

The second weakness involves how SCCM validates CAB package signatures.

SCCM checks whether a CAB archive contains a valid embedded signature, but researchers found that it did not properly verify that the signing certificate belonged to Microsoft or the victim organization.

The validation process also reportedly failed to perform certificate revocation checks.

This could allow an attacker to use an otherwise accepted certificate to sign a malicious SCCM extension package.

3. "CabSlip" Path Traversal

Researchers also identified a path traversal vulnerability dubbed "CabSlip."

During CAB archive extraction, SCCM reportedly failed to properly block relative path sequences.

A specially crafted archive could therefore write files outside the intended temporary extraction directory.

This provides an attacker with arbitrary file write capability on the SCCM primary site server.

4. SYSTEM-Level DLL Hijacking

The final stage of the attack abuses DLL loading behavior in the SMS Executive service.

SMS Executive operates with:

NT AUTHORITY\SYSTEM

privileges.

Although the service validates a primary DLL, researchers found that it can load a secondary DLL named:

adsource.dll

without applying equivalent integrity checks.

An attacker who exploits the path traversal vulnerability could overwrite this DLL with a malicious version.

When SCCM subsequently loads the library, the attacker's code could execute with SYSTEM-level privileges.

Attack Chain

The complete attack can be summarized as:

Standard AD Domain User
        ↓
AdminService Chunked Upload
        ↓
Authorization Bypass
        ↓
Malicious CAB Extension
        ↓
Weak Certificate Validation
        ↓
CabSlip Path Traversal
        ↓
Arbitrary File Write
        ↓
Overwrite adsource.dll
        ↓
SMS Executive Loads DLL
        ↓
SYSTEM-Level Code Execution

Microsoft Patch Status

Microsoft's July 2026 security update prevents standard domain users from abusing the vulnerable chunked upload endpoint.

However, XM Cyber researchers warned that users assigned the built-in Operations Administrator role, or users with a custom role containing Create permission on the SMS_ConsoleExtensionData object, may still be able to access portions of the downstream attack path.

Microsoft is expected to address the remaining weaknesses in Configuration Manager 2609, currently planned for October 2026.

Detection and Mitigation

Organizations operating SCCM should treat this attack chain as a high-priority security concern.

Defenders should:

  • Monitor AdminService.log for unexpected DirectoryNotFoundException errors followed by HTTP 500 responses.
  • Investigate unusual CAB package upload activity.
  • Monitor for unexpected modifications to adsource.dll.
  • Restrict network access to the SCCM AdminService port.
  • Review SCCM role assignments and remove unnecessary permissions.
  • Pay particular attention to users with Operations Administrator or custom roles granting Create permission on SMS_ConsoleExtensionData.
  • Apply Microsoft's July 2026 security updates.
  • Upgrade to the fully patched Configuration Manager release once Microsoft's remaining fixes become available.

Because SCCM has privileged access across large portions of an enterprise Windows environment, compromise of the primary site server could provide an attacker with a powerful platform for lateral movement, software deployment abuse, persistence, and domain-wide compromise.

Organizations should therefore prioritize restricting access to SCCM administrative interfaces and closely monitor extension package uploads and unexpected DLL modifications until the complete attack chain is fully remediated.