Microsoft SCCM Vulnerability Chain Enables Remote Code Execution by Domain Users
Researchers have detailed a sophisticated attack chain targeting Microsoft SCCM, allowing a standard domain user to achieve SYSTEM-level remote code execution on primary site servers.
Security researchers have disclosed a critical attack chain targeting Microsoft System Center Configuration Manager (SCCM), a widely used tool for managing Windows environments. The vulnerabilities, reported by XM Cyber, could allow an attacker with only standard Active Directory domain user privileges to execute malicious code remotely on an SCCM primary site server. This level of access could grant an attacker control over an organization's entire managed Windows infrastructure, including software deployment, patching, and device management.
The attack chain leverages a combination of flaws, beginning with an issue in SCCM's AdminService REST API. While one upload endpoint for console extension packages properly checks for role-based access control permissions, a chunked upload endpoint does not. This allows an authenticated domain user to submit specially crafted CAB files to the server without sufficient authorization.
Following the initial access, the attack exploits a weakness in signature validation. SCCM verifies that a CAB archive has a valid embedded signature but reportedly fails to enforce that the signing certificate belongs to a trusted entity like Microsoft or the victim organization. Furthermore, it skips certificate revocation checks, enabling an attacker to use a compromised or self-signed certificate to sign a malicious extension package.
A third vulnerability, dubbed "CabSlip," involves a path traversal flaw during the extraction of CAB archives. SCCM's extraction process does not adequately sanitize relative path sequences, allowing an attacker to write files to arbitrary locations on the site server, including critical system directories.
The final stage of the attack abuses the DLL loading behavior of the SMS Executive service, which runs with SYSTEM privileges. While the service validates a primary DLL, it can be tricked into loading a secondary DLL, named adsource.dll, without performing equivalent integrity checks. By overwriting this adsource.dll using the path traversal vulnerability, an attacker ensures their malicious code is executed with SYSTEM-level privileges when SCCM loads the library.
Microsoft has addressed the initial authorization flaw with a patch for CVE-2026-47301, released in July 2026. However, the researchers note that the remaining weaknesses in the attack chain are still unpatched. Microsoft plans to include further fixes in the upcoming ConfigMgr 2609 release, expected in October 2026. Until then, organizations using SCCM are advised to implement specific monitoring and mitigation strategies.
Defenders should monitor AdminService.log for specific error patterns and inspect for unexpected CAB upload activity. Additionally, vigilance for unauthorized modifications to adsource.dll within the Configuration Manager installation directory is crucial. Restricting network access to the AdminService port and thoroughly reviewing SCCM role assignments are recommended immediate steps to reduce the attack surface until a complete solution is deployed.