CyberICT

CVE-2026-70049

Microsoft · Published October 13, 2026

CVSS v3.1

HIGH
Patch availableGet patch

Description

Microsoft Configuration Manager Elevation of Privilege Vulnerability. Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.

Affected Products

  • Microsoft Configuration Manager 2503
  • Microsoft Configuration Manager 2509
  • Microsoft Configuration Manager 2603

CVSS Vector

CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C