Microsoft Configuration Manager EUVD-2026-100146

Exploitation requires an existing authorized (authenticated) account on the network per the CVSS vector (PR:L) and the description's 'authorized attacker' wording - this is the primary limiting factor, as it is not exploitable by fully unauthenticated attackers. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once valid low-privilege credentials or an authenticated session exist, injection is reliable. The description does not name the specific vulnerable feature, console component, or input parameter, so defenders cannot scope to a non-default configuration; treat all affected Configuration Manager builds (versions below 5.00.9141.1039 for 2509, 5.00.9146.1026 for 2603, and 5.00.9135.1040) as exploitable until patched.

This is a CVSS 8.8 (High) SQL injection (CWE-89) in Microsoft Configuration Manager that an authenticated network attacker can leverage to elevate privileges. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation requiring low-level privileges and no user interaction, with total impact (C:H/I:H/A:H) consistent with SQLi against a central management/database backend. However, the exploitation signals temper the urgency: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (though Technical Impact is 'total'), and there is no KEV listing and no public exploit identified at time of analysis. The combination - real technical severity but no evidence of active or automatable exploitation, plus a prerequisite of existing authenticated access - suggests this is a legitimate patch-priority item for environments running Config Manager rather than an emergency internet-facing 0-day. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Net: patch promptly given the privileged, total-impact nature and ubiquity of SCCM in enterprises, but the lack of KEV/POC/automatability indicates this is not currently under mass exploitation.

An attacker who already holds a low-privilege authenticated account (or has compromised one) on the network sends a crafted request to a Configuration Manager component, injecting malicious SQL that is improperly neutralized. The SQL executes against the backend database, allowing the attacker to read/modify data and escalate to higher privileges within the Config Manager environment. No public exploit code is identified at time of analysis, and CVSS AC:L indicates the injection is straightforward once authenticated access is obtained.