Security researcher Omri Baso has disclosed a remote code execution chain in Microsoft Configuration Manager (SCCM/ConfigMgr) that lets an ordinary Active Directory user seize SYSTEM control of a Primary Site Server — and every client it manages. Microsoft has patched only one link in that chain, CVE-2026-47301, leaving the full path to code execution open until a later release.
CVE-2026-47301 is a missing role-based access control (RBAC) check in the SCCM AdminService REST API. SentinelOne's advisory rates it at CVSS 8.8 (High) under CWE-284, improper access control; Microsoft rates it as an elevation-of-privilege flaw.
On its own, it is the entry point, Baso — a researcher at XM Cyber — chained with three still-unpatched bugs to run code as NT AUTHORITY\SYSTEM. He reported the chain to Microsoft on 23 May 2026 and says roughly 100 million SCCM clients are managed worldwide.
How the SCCM Exploit Chain Works
The AdminService exposes two console-extension upload endpoints. UploadExtension enforces a permission check; its chunked twin, UploadExtensionInChunks, does not — that gap is CVE-2026-47301, and it lets any authenticated domain user submit a malicious CAB archive without holding a single SCCM role.
From there, the chain runs through three flaws Baso detailed publicly: a path-traversal bug he named CabSlip, which lets files inside the CAB escape the extraction folder and write anywhere the service can reach; weak Authenticode validation that accepts any non-revoked code-signing certificate — including a $58 commercial one — because revocation checking is skipped on that path; and an insecurely loaded DLL adsource.dll, pulled in every few minutes by the SYSTEM-level smsexec.exe (SMS Executive) process. Planting a malicious adsource.dll in the install directory turns the file write into reliable SYSTEM code execution on the site server. It mirrors the partial-fix pattern seen in Microsoft's recent SharePoint RCE chain (CVE-2026-63520).
Which SCCM Versions Are Affected?
| Configuration Manager (current branch) | Status | Fix |
|---|---|---|
| Version 2603 | Affected | KB38232642 (in-console) |
| Version 2509 | Affected | Second 2509 update rollup (KB37864969) |
| Version 2503 | Affected | KB38232642, requires rollup KB32851084 |
Has Microsoft Patched It?
Microsoft addressed the broken-access flaw in hotfix KB38232642, available in the Updates and Servicing node for version 2603, for 2503 with update rollup KB32851084 installed, and rolled into the second 2509 update rollup — no separate out-of-band hotfix is needed there. The update requires no computer restart or site reset.
The fix removes the any-domain-user route, but not the chain. The other three flaws stay unpatched until ConfigMgr 2609, expected in October 2026. A user holding the built-in Operations Administrator role — or any custom role with Create (1024) on SMS_ConsoleExtensionData — can still reach the same RCE through UploadExtension. XM Cyber judges that route lower risk, since Operations Administrator is already a highly privileged role. It is the second time in weeks that Microsoft has shipped a fix that closes only part of a disclosed issue, after it left a Windows passkey prompt spoofing flaw unaddressed.
How to Detect SCCM CVE-2026-47301 Exploitation
Failed extraction attempts leave a trail. Check <InstallationDir>\Logs\AdminService.log for a System.IO.DirectoryNotFoundException followed by a 500 Internal Server Error — the folder GUID changes on each run, so match the pattern, not the exact string. Beyond that, forward SMS Provider and AdminService logs to your SIEM and alert on authenticated AdminService requests from non-administrative hosts, console role or security-scope changes made by low-privileged accounts, and unexpected new administrative assignments.
There is no public report of in-the-wild exploitation, and the flaw is not in CISA's KEV catalog, though Baso's full exploit suite is on GitHub. Both Microsoft's guidance and the researcher recommend restricting access to the AdminService port on administrative subnets via a firewall as the most reliable containment measure until the chain is fully closed.
Frequently Asked Questions
What is CVE-2026-47301?
It is a missing RBAC check in the SCCM AdminService's chunked console-extension upload endpoint, allowing any domain user to submit a CAB archive without an SCCM role. It is one link in a four-flaw RCE chain.
Does KB38232642 fully fix the SCCM RCE?
No. KB38232642 patches only CVE-2026-47301 — the broken-access entry point. The path traversal, weak signature check, and DLL hijack remain unpatched until ConfigMgr 2609 in October 2026.
Which SCCM versions need patching?
Configuration Manager current branch versions 2503 (with rollup KB32851084), 2509, and 2603.