In brief: A chain of four SCCM vulnerabilities allows domain users to gain SYSTEM privileges on the site server, with only one of the flaws patched so far.
Security researchers at XM Cyber have demonstrated an attack chain against Microsoft System Center Configuration Manager (SCCM) that allows an ordinary domain user without SCCM permissions to achieve code execution as NT AUTHORITYSYSTEM. Microsoft closed part of the flaws in July, but a complete fix is not planned until ConfigMgr 2609 in October.
Organizations use Microsoft SCCM to deploy operating systems, manage patches, roll out software, and monitor compliance across large Windows environments. According to XM Cyber, an attacker with a plain domain account and network access to the SCCM environment can combine a chain of four vulnerabilities to achieve code execution with SYSTEM privileges on the primary site server. Omri Baso of XM Cyber told CSO that compromising the site server also affects all managed clients, which typically means the takeover of all enterprise assets.
The starting point is a flawed authorization check in SCCM’s AdminService API: while the normal extension upload endpoint verifies the required permissions, its associated “chunked upload” counterpart does not. This allows an authenticated Active Directory user without SCCM administrator rights to submit a malicious CAB archive. This vulnerability is tracked as CVE-2026-47301 and was closed by Microsoft in July. According to XM Cyber, however, the downstream path of the attack chain remains reachable — for example, via users with the built-in “Operations Administrator” role or via a custom role with create permission for “SMS_ConsoleExtensionData”. XM Cyber assesses the resulting residual risk as limited, since the Operations Administrator role is already highly privileged.
Once the CAB archive reaches the server, a path traversal vulnerability dubbed “CabSlip” makes it possible to write files outside the intended temporary extraction directory. An attacker exploits this arbitrary write capability to replace the “adsource.dll” library, which is loaded by the SYSTEM service SMS Executive without its own signature check. The next time the DLL is loaded, the attacker gains code execution as SYSTEM. Particularly notable: SCCM’s signature validation only checks whether a signature is structurally valid and not expired — not whether the certificate actually originates from Microsoft or the target organization — and revocation checks are disabled. For his research, Baso used a Certum Open Source Developer Certificate costing around $58; leaked certificates could likewise be abused for the attack.
For CISOs, XM Cyber recommends restricting network access to the AdminService API and auditing RBAC assignments in SCCM, particularly accounts with the Operations Administrator role or equivalent create permissions. As a detection indicator, teams should monitor the “AdminService.log” on the site server for the error message “System.IO.DirectoryNotFoundException” followed by an HTTP 500 response, which can indicate a triggered path traversal attempt. Unexpected changes to the adsource.dll file in the Configuration Manager installation directory provide another detection signal. Microsoft is reportedly working on patches for the remaining vulnerabilities; a statement in response to CSO’s inquiry was not immediately available.
Source: www.csoonline.com · Published August 13, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.