SQL injection in Configuration Manager - CVE-2026-70049
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote user on the local network to escalate privileges and gain administrative control of the Configuration Manager environment.
The vulnerability exists due to sql injection in Microsoft Configuration Manager when processing specially crafted data. A remote user on the local network can submit specially crafted data to an affected system to escalate privileges and gain administrative control of the Configuration Manager environment.
Exploitation requires access to a restricted internal network and the ability to authenticate as a Configuration Manager management point by relaying the Management Point machine identity. This prerequisite depends on a separate chain and is not provided by this vulnerability. User interaction is not required.