SB2026101431 - SQL injection in Configuration Manager

Description

This security bulletin contains information about 1 vulnerability.

1) SQL injection (CVE-ID: CVE-2026-70049)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user on the local network to escalate privileges and gain administrative control of the Configuration Manager environment.

The vulnerability exists due to sql injection in Microsoft Configuration Manager when processing specially crafted data. A remote user on the local network can submit specially crafted data to an affected system to escalate privileges and gain administrative control of the Configuration Manager environment.

Exploitation requires access to a restricted internal network and the ability to authenticate as a Configuration Manager management point by relaying the Management Point machine identity. This prerequisite depends on a separate chain and is not provided by this vulnerability. User interaction is not required.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70049
• https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2603/39398030