What is the CVSS score of CVE-2026-47301?

CVE-2026-47301 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Microsoft Configuration Manager are affected by CVE-2026-47301?

Microsoft Configuration Manager (versions 2509 and 2603) contains a privilege escalation vulnerability that enables low-privileged network users with existing system access to achieve full…. A patch is available.

How to fix or mitigate CVE-2026-47301?

Within 24 hours, identify all systems running Configuration Manager versions 2509 and 2603 and assess network exposure to low-privileged users. Within 7 days, obtain and test the vendor-released patch from Microsoft in a staging environment to ensure compatibility with your ConfigMgr deployment. Within 30 days, deploy the patch to all affected production systems, prioritizing systems managing critical business infrastructure, and verify patching completion through configuration management records.

Microsoft Configuration Manager CVE-2026-47301

EUVD-2026-44352 HIGH

Improper Access Control (CWE-284)

2026-07-14 microsoft

GHSA-c9fw-992q-vr57

Authentication Bypass Microsoft Microsoft Configuration Manager Microsoft Configuration Manager 2509 Microsoft Configuration Manager 2603

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.7 HIGH

cvss

vuln.today AI

8.8 HIGH

Network-reachable escalation from an existing low-privileged authorized account (PR:L), no user interaction, low complexity, with full compromise of the ConfigMgr system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:11 vuln.today

CVE Published

Jul 14, 2026 - 18:45 nvd

HIGH 8.8

DescriptionCVE.org

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Configuration Manager (versions 2509 and 2603) lets an already-authorized, low-privileged network user gain elevated privileges due to improper access control. Rated CVSS 8.8, the flaw yields full confidentiality, integrity, and availability impact and is remotely reachable, though it requires existing valid low-level access. Microsoft has released a patch; no public exploit identified at time of analysis.

Technical ContextAI

Microsoft Configuration Manager (formerly SCCM/MECM) is an enterprise endpoint and systems-management platform used to deploy software, patches, OS images, and configuration policy to large fleets of Windows devices, typically via a site server that holds high-trust roles across a domain. The root cause is CWE-284 (Improper Access Control), meaning an access-control decision within the product fails to properly restrict what an authenticated principal can do - the tags also characterize it as an Authentication Bypass. The affected CPEs are cpe:2.3:a:microsoft:microsoft_configuration_manager (generic), _2509, and _2603, identifying the specific serviced branches at risk; because ConfigMgr components are often privileged within Active Directory, an access-control gap here can translate directly into broader network privilege.

RemediationAI

Patch available per vendor advisory - apply the Microsoft-provided update for Configuration Manager referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47301, prioritizing site servers and the 2509 and 2603 branches. As the input does not include an exact fixed build number, obtain the specific update/hotfix version from the MSRC Update Guide entry and validate the resulting site version after installation. Until patched, reduce exposure by tightening who holds any authorized ConfigMgr access (the attack requires low existing privileges): restrict and audit ConfigMgr role assignments and administrative scopes, limit network reachability of site server roles to trusted management subnets, and monitor for anomalous privilege changes - with the trade-off that network restrictions may disrupt legitimate remote administration and client-server communication and should be tested against your deployment topology.