High severity8.0NVD Advisory· Published Oct 13, 2026· Updated Oct 13, 2026

CVE-2026-70049

Description

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.

Affected products

Microsoft/Configuration Managerllm-fuzzy

Patches

Vulnerability mechanics

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70049nvd

News mentions

No linked articles in our index yet.

cvss	0.520
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000