CVE-2026-88075
HighCVSS 8.8Summary
SQL injection vulnerability in Microsoft Configuration Manager due to improper neutralization of special elements in SQL commands. An authorized attacker can elevate privileges over a network.
Risk Assessment
An attacker with valid credentials can remotely exploit this to escalate privileges, potentially leading to unauthorized access to data and resources.
Recommendation
Apply the latest security updates for Microsoft Configuration Manager and review service account permissions.
Other vulnerabilities in Microsoft Configuration Manager
See all- CVE-2026-70049High
An SQL injection vulnerability exists in Microsoft Configuration Manager. An authorized attacker can exploit this flaw to elevate privileges over an adjacent network.
- CVE-2026-47301High
An improper access control vulnerability in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. The flaw can be exploited remotely by an authenticated user.
Original NVD description (English source)
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS