CVE-2026-47301: PoC Exploit Achieves SYSTEM-Level Code Execution in SCCM

TL;DR

Microsoft patched CVE-2026-47301, an elevation of privilege flaw in Configuration Manager (SCCM). A researcher published proof-of-concept exploit code and a full writeup. The chain lets a plain domain user reach SYSTEM-level code execution on the primary site server. Microsoft rates the bug Important with a CVSS score of 8.8.

Why It Matters

SCCM manages software and patches across entire enterprise fleets. This CVE-2026-47301 flaw hands an ordinary domain user a path toward full control. From the site server, an attacker can command every managed endpoint.

Researcher Omri Baso of XM Cyber disclosed the chain. Notably, CVE-2026-47301 is only the entry point of a four-link chain. Microsoft fixed this link in July 2026, yet reporting says the other links wait for ConfigMgr 2609 in October.

How the Attack Works

SCCM exposes upload endpoints through its AdminService REST API. The standard extension-upload endpoint checks permissions. Its chunked-upload counterpart, however, skips that check.

Because of that gap, an authenticated domain user can submit a malicious CAB archive without SCCM admin roles. The public proof-of-concept for CVE-2026-47301 then plants two DLLs to hijack a service through DLL proxying. As a result, the SMS_EXECUTIVE service loads attacker code and runs it as SYSTEM. Baso details the full chain in his Medium writeup on the exploit chain.

Affected Versions

The flaw affects Microsoft Configuration Manager current branch releases 2503, 2509, and 2603. The official Microsoft advisory for CVE-2026-47301 lists the fixed builds.

Patch and Mitigation Steps

First, apply Microsoft‘s July 2026 update for Configuration Manager. Confirm your site is on a patched build.

Next, audit accounts with upload and console-extension permissions, since some roles can still reach the downstream chain. You should also monitor SMSProv.log and watch for unexpected role or admin changes. No confirmed in-the-wild exploitation has been reported. Even so, public exploit code raises the risk, so patch without delay.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.