Known vulnerabilities in Configuration Manager

Known vulnerabilities in Configuration Manager

Vendor: Microsoft

Software: Configuration Manager

Software CPE: cpe:2.3:a:microsoft:configuration_manager:*:*:*:*:*:*:*:*

Website: https://www.microsoft.com

Total vulnerabilities: 9

Public exploits: 4

Known exploited (KEV): 1

Breakdown by Severity Chart

Vulnerabilities (9)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU155777 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2026-88075	CWE-89	Medium	No	No	5.00.9135.1040, 5.00.9141.1039, 5.00.9146.1026	14.10.2026	SB2026101483
#VU155651 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2026-70049	CWE-89	Medium	No	No	5.00.9135.1042, 5.00.9141.1041, 5.00.9146.1027	14.10.2026	SB2026101431
#VU137877 - Improper Access Control CVE-2026-47301	CWE-284	Medium	Available	No	-	16.07.2026	SB2026071620
#VU118285 - Improper Access Control CVE-2025-47179	CWE-284	Low	No	No	-	11.11.2025	SB2025111155
#VU117794 - Authentication Bypass by Spoofing CVE-2025-59501	CWE-290	Medium	Available	No	5.00.9128.1037, 5.00.9132.1031, 5.0.9135.1013	29.10.2025	SB2025102958
#VU117220 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2025-55320	CWE-89	Low	No	No	5.00.9128.1035, 5.00.9132.1029, 5.00.9135.1008	15.10.2025	SB2025101579
#VU117219 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2025-59213	CWE-89	Low	No	No	5.00.9128.1035, 5.00.9132.1029, 5.00.9135.1008	15.10.2025	SB2025101579
#VU112597 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2025-47178	CWE-89	Medium	Available	No	5.00.9135.1003	09.07.2025	SB2025070948
#VU98257 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CVE-2024-43468	CWE-89	High	Available	Exploited	-	09.10.2024	SB2024100921