9.8
Critical
Exploited
CVE-2024-43468 Microsoft Configuration Manager SQL Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-89
Description
Microsoft Configuration Manager Remote Code Execution Vulnerability
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Configuration Manager 1.0 | 1.0.0 → < 5.00.9106 | 5.00.9106 |
References
- Microsoft Configuration Manager Remote Code Execution Vulnerability msrc.microsoft.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Microsoft Configuration Manager
The 9 CVEs of Microsoft Configuration Manager →
CVE-2026-88075
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration…
8.8
High
CVE-2026-70049
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration…
8.0
High
CVE-2026-47301
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a…
8.8
High
CVE-2025-47179
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally
6.7
Medium