Read the docs
TI-2026-72879 Aliases CVE-2026-88075GHSA-39vx-m3rf-px34

SQL injection in Microsoft Configuration Manager allows privilege escalation

Priority MEDIUM 42CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Microsoft Configuration Manager from 1.0.0 before 5.00.9135.1040, Microsoft Configuration Manager 2509 from 1.0.0 before 5.00.9141.1039, and Microsoft Configuration Manager 2603 from 1.0.0 before 5.00.9146.1026 are affected. An SQL injection flaw (CWE-89) occurs because special characters in an SQL command are not neutralized. An authorized attacker on the network with low privileges can gain higher privileges over the network.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00831 57th percentileScored 2026-11-07
Fix Fixed Microsoft Configuration Manager (Microsoft): 5.00.9135.1040Microsoft Configuration Manager 2509 (Microsoft): 5.00.9141.1039+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Configuration Manager1.0.0 to before 5.00.9135.10405.00.9135.1040Patch availableCNA
MicrosoftMicrosoft Configuration Manager 25091.0.0 to before 5.00.9141.10395.00.9141.1039Patch availableCNA
MicrosoftMicrosoft Configuration Manager 26031.0.0 to before 5.00.9146.10265.00.9146.1026Patch availableCNA
  • Microsoft Configuration Manager VendorMicrosoft Affected 1.0.0 to before 5.00.9135.1040 Fixed in 5.00.9135.1040 Patch available CNA
  • Microsoft Configuration Manager 2509 VendorMicrosoft Affected 1.0.0 to before 5.00.9141.1039 Fixed in 5.00.9141.1039 Patch available CNA
  • Microsoft Configuration Manager 2603 VendorMicrosoft Affected 1.0.0 to before 5.00.9146.1026 Fixed in 5.00.9146.1026 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:configuration_manager_2503:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:configuration_manager_2509:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:configuration_manager_2603:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
  • cpe:2.3:a:microsoft:configuration_manager_2503:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:configuration_manager_2509:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:configuration_manager_2603:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft

Remediation

Install the fixed versions 5.00.9135.1040 for Microsoft Configuration Manager, 5.00.9141.1039 for Microsoft Configuration Manager 2509, and 5.00.9146.1026 for Microsoft Configuration Manager 2603.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Microsoft Configuration Manager (Microsoft) Fixed in 5.00.9135.1040
  • Fix · CNA Microsoft Configuration Manager 2509 (Microsoft) Fixed in 5.00.9141.1039
  • Fix · CNA Microsoft Configuration Manager 2603 (Microsoft) Fixed in 5.00.9146.1026

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-88075
  2. 2026-10-13 Alias added: GHSA-39vx-m3rf-px34
  3. 2026-10-14 CISA SSVC decision points changed
  4. 2026-10-14 Priority changed: LOW → MEDIUM
  5. 2026-10-21 EPSS moved to the 50th–90th percentile

References

Patch 1

  • TI-2024-29113 Microsoft Configuration Manager Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-34878 Configuration Manager Elevation of Privilege Vulnerability CVSS 3.1HIGH 8.8
  • TI-2025-29763 Microsoft Configuration Manager Remote Code Execution Vulnerability CVSS 3.1HIGH 8.0
  • TI-2025-36803 Configuration Manager Elevation of Privilege Vulnerability CVSS 3.1HIGH 8.8
  • TI-2025-34974 Configuration Manager Elevation of Privilege Vulnerability CVSS 3.1MEDIUM 6.8
  • TI-2025-29764 Configuration Manager Elevation of Privilege Vulnerability CVSS 3.1MEDIUM 6.7
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences