Kiran 
A newly disclosed exploit chain in Microsoft’s System Center Configuration Manager (SCCM) shows how four seemingly minor coding shortcuts can add up to a full enterprise takeover no admin rights, no phishing, and no user interaction required.
Security researcher Omri Baso, working with XM Cyber, disclosed the chain on August 13, 2026, after reporting it to Microsoft on May 23.
Domain Users Can Hijack Microsoft’s Site Server
The path starts with CVE-2026-47301, a broken access-control flaw in SCCM’s AdminService REST API. The UploadExtension endpoint properly enforces a permission check, but its chunked counterpart, UploadExtensionInChunks, never calls CheckAccess() at all letting any authenticated Active Directory user submit a .cab package with zero SCCM role assignment.
From there, SCCM’s signature verification proves toothless: it checks that a .cab is signed and unexpired, but skips Certificate Revocation List checks and never confirms the signer’s identity. A $58 commercial code-signing certificate is enough to make a malicious package look “trusted”.
Next comes “CabSlip,” Baso’s name for a Zip-Slip-style path-traversal bug in the CAB extraction routine CabinetUtils.GetFileName, which strips root path markers but ignores relative traversal sequences (../). That gives an attacker an arbitrary file-write primitive anywhere on the site server’s disk.
The final link weaponizes that write: SMS Executive, SCCM’s SYSTEM-level background service, periodically loads adsysdis.dll, which itself dynamically loads a second library, adsource.dll, from the install directory with no signature check whatsoever.
Overwrite that file via CabSlip, wait a few minutes, and the attacker’s code executes as NT AUTHORITY\SYSTEM on the primary site server that governs an entire fleet.
Microsoft shipped hotfix KB38232642 in July, closing the RBAC gap behind CVE-2026-47301 for ConfigMgr versions 2503, 2509, and 2603.
That stops anonymous domain users from reaching the chunked upload endpoint cold. But independent researchers and Baso’s own public proof-of-concept show the remaining three bugs the certificate bypass, CabSlip, and the DLL hijack are still live, and Microsoft isn’t planning a full fix until ConfigMgr 2609, expected in October 2026.
That leaves a meaningful gap: any account holding SCCM’s built-in Operations Administrator role, or a custom role with Create permission on SMS_ConsoleExtensionData, can still call the patched UploadExtension endpoint through its front door and trigger the identical downstream chain, a scenario Microsoft’s own documentation says that role shouldn’t be capable of.
A public PoC, released within days of disclosure, confirms the chain is generic across SCCM installation paths and can be used to enable and repurpose the built-in RID 500 Administrator account.
Mitigation
Until ConfigMgr 2609 lands, defenders have concrete signals to hunt for. CabSlip’s traversal breaks the AdminService’s post-extraction cleanup, throwing a System.IO.DirectoryNotFoundException followed by an HTTP 500 in <InstallationDir>\Logs\AdminService.log a distinctive fingerprint worth alerting.
Practical steps for security teams:
- Apply KB38232642 immediately across all site servers running 2503, 2509, or 2603.
- Restrict network access to the AdminService API port via firewall rules, since disabling its underlying process isn’t supported by Microsoft.
- Monitor file integrity on
adsource.dllinside the Configuration Managerbin\x64directory. - Audit and tightly restrict Operations Administrator assignments and any custom role granting
CreateonSMS_ConsoleExtensionData.
With SCCM embedded across an estimated 100 million endpoints, the gap between “patched” and “fixed” here isn’t academic; it’s the difference between closing a door and locking the house.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
