Configuration Manager 2509
Monthly
SQL injection in Microsoft Configuration Manager (MECM) lets an authenticated attacker with low-privilege network access execute arbitrary SQL against the site database and thereby elevate privileges, with high confidentiality, integrity, and availability impact (CVSS 8.8). The CVSS vector (AV:N/AC:L/PR:L/UI:N) means exploitation requires a pre-existing valid account on the network - fully unauthenticated attackers cannot reach the flaw - but no user interaction or special complexity is needed once such credentials or an authenticated session exist. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no active exploitation, while vendor patches for all affected builds are available.
SQL injection in Microsoft Configuration Manager (MECM) lets an authenticated attacker with low-privilege network access execute arbitrary SQL against the site database and thereby elevate privileges, with high confidentiality, integrity, and availability impact (CVSS 8.8). The CVSS vector (AV:N/AC:L/PR:L/UI:N) means exploitation requires a pre-existing valid account on the network - fully unauthenticated attackers cannot reach the flaw - but no user interaction or special complexity is needed once such credentials or an authenticated session exist. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no active exploitation, while vendor patches for all affected builds are available.