CVE-2026-70049
HighCVSS 8.0Summary
An SQL injection vulnerability exists in Microsoft Configuration Manager. An authorized attacker can exploit this flaw to elevate privileges over an adjacent network.
Risk Assessment
An attacker with valid credentials on an adjacent network can elevate privileges, potentially leading to compromise of managed systems.
Recommendation
Apply security updates for Microsoft Configuration Manager and restrict network access to the management server.
Other vulnerabilities in Microsoft Configuration Manager
See all- CVE-2026-88075High
SQL injection vulnerability in Microsoft Configuration Manager due to improper neutralization of special elements in SQL commands. An authorized attacker can elevate privileges over a network.
- CVE-2026-47301High
An improper access control vulnerability in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. The flaw can be exploited remotely by an authenticated user.
Original NVD description (English source)
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS