Microsoft Configuration Manager CVE-2026-70049

Exploitation requires (1) the attacker to already possess a valid low-privilege authorization (PR:L - an authenticated/authorized actor, per the CVSS vector, not an anonymous outsider), and (2) network position on a segment adjacent to the Configuration Manager site/SQL infrastructure (AV:A - not routable from the public internet). The high attack complexity (AC:H) indicates additional non-trivial preconditions must be met, such as specific timing, state, or configuration, so this is not reliably repeatable against a default posture. The limiting factors - required prior authorization, adjacent-only reach, and high complexity - meaningfully constrain real-world exploitation despite the 'total' technical impact, and these are confirmed by the vector rather than inferred from description text. No end-user interaction is required (UI:N).

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.0) describes an authenticated attacker (PR:L) on an adjacent network segment who, through a high-complexity attack (AC:H), achieves a scope-changing (S:C) compromise with total confidentiality, integrity, and availability impact. These signals are internally consistent and align with the SSVC assessment of Technical Impact: total. However, the mitigating signals are strong: the attack vector is adjacent (not internet-facing Network), attack complexity is High, and some level of existing authorization is required. Crucially, the SSVC framework reports Exploitation: none and Automatable: no, and no CISA KEV listing or public exploit is present in the data, so there is no public exploit identified at the time of analysis. No EPSS score was supplied, which limits probabilistic exploitation estimation. The combination of 'total' technical impact with 'not automatable' and 'no observed exploitation' suggests a high-severity flaw that would require a skilled, positioned, already-authorized attacker rather than opportunistic mass exploitation - prioritize patching for internet-adjacent or multi-tenant management segments, but the realistic near-term exploitation likelihood is moderate.

An attacker who already holds low-level authorized access and a foothold on a network segment adjacent to the Configuration Manager infrastructure submits crafted input that is improperly neutralized and passed into a SQL command (CWE-89). By winning the race or satisfying the complex preconditions implied by AC:H, the attacker injects SQL that elevates their privileges and compromises the management database, crossing a security boundary (S:C). No public exploit code is identified at the time of analysis, so exploitation would require custom development.