Security researchers have identified a serious exploit chain affecting Microsoft System Center Configuration Manager (SCCM/ConfigMgr) that could allow attackers to achieve remote code execution on an SCCM primary site server. The attack is particularly concerning because it can begin with a standard Active Directory domain user who does not require SCCM administrator privileges, elevated Windows permissions, or user interaction. Since the primary site server manages critical functions such as software deployment, patching, operating-system installation, compliance monitoring, and device management, successful exploitation could provide an attacker with significant control over an organization’s managed Windows environment.

The chain begins with a broken authorization issue in SCCM’s AdminService REST API, tracked as CVE-2026-47301. SCCM allows console extension packages to be uploaded through CAB archives, but while one upload endpoint properly enforced role-based access controls, a chunked-upload endpoint reportedly failed to perform the same authorization check. This allowed authenticated domain users to upload specially crafted CAB files. Researchers at reported the vulnerabilities to Microsoft on May 23, 2026, and Microsoft released a fix for CVE-2026-47301 on July 14, 2026. However, researchers stated that additional weaknesses required to complete the attack chain remained unpatched, with Microsoft planning further fixes in Configuration Manager 2609, expected in October 2026.

The remaining weaknesses involve signature validation and a path traversal vulnerability known as “CabSlip.” SCCM reportedly verified that a CAB package contained a valid embedded signature but did not sufficiently confirm that the signing certificate belonged to Microsoft or the victim organization, while also failing to perform certificate-revocation checks. The CabSlip flaw could then allow specially crafted CAB archives to escape their intended extraction directory and write arbitrary files elsewhere on the SCCM server. Attackers could potentially overwrite adsource.dll, a secondary DLL loaded by the SMS Executive service, which operates with NT AUTHORITY\SYSTEM privileges. When the service subsequently loads the malicious DLL, the attacker could execute code with SYSTEM-level privileges, turning an initially low-privileged domain account into complete control of the SCCM server.

Microsoft’s July update blocks standard domain users from abusing the vulnerable chunked-upload endpoint, but organizations should still treat the issue as a high-priority security concern because users with the built-in Operations Administrator role or custom roles granting Create permission on SMS_ConsoleExtensionData may remain relevant to the downstream attack path. Defenders should review SCCM role assignments and minimize unnecessary privileges, restrict access to the AdminService network port, monitor AdminService.log for suspicious DirectoryNotFoundException events followed by HTTP 500 responses, investigate unexpected CAB uploads, and monitor for unauthorized modifications to adsource.dll. Organizations should apply Microsoft’s available security update immediately and continue monitoring for the additional fixes expected in Configuration Manager 2609.