Reported by 2 outlets
PoC Exploit Released for Microsoft SCCM Attack Chain From Domain User to SYSTEM
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from gbhackers.com
PoC Exploit Released for Microsoft SCCM Vulnerability Enabling SYSTEM-Level Code Execution
gbhackers.com · 56d ago · August 18th, 2026
A recently disclosed proof-of-concept (PoC) exploit for Microsoft Configuration Manager, previously known as System Center Configuration Manager (SCCM), demonstrates how an authenticated domain user could potentially escalate privileges to SYSTEM on a vulnerable Primary Site Server. This issue, tracked as CVE-2026-47301, was reported by security researcher Omri Baso and is characterized as an exploit chain […] The post PoC Exploit Released for Microsoft SCCM Vulnerability Enabling SYSTEM-Level Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
PoC Exploit Released for Microsoft SCCM Attack Chain From Domain User to SYSTEM
cyberpress.org · 56d ago · August 18th, 2026
A proof-of-concept exploit chain targeting Microsoft Configuration Manager (formerly SCCM) has been publicly released after being assigned the CVE-2026-47301 identifier. The research describes a path from a low-privileged domain user to SYSTEM-level code execution on a Configuration Manager Primary Site Server, potentially placing enterprise management infrastructure at risk. According to Omri Baso, the attack combines multiple weaknesses in the Configuration Manager processing workflow: broken access control, CAB archive extraction path traversal, arbitrary file write, certificate verification bypass, and DLL hijacking. Together, these issues reportedly allow an authenticated Active Directory user to place malicious files in the Configuration Manager installation directory and wait for a privileged service to load them. PoC Exploit Released for Microsoft SCCM Attack Chain The core technique relies on a specially crafted CAB archive. Rather than requiring knowledge of the SCCM installation path, the archive uses traversal sequences to write files relative to the intended extraction directory. The PoC reportedly drops two DLLs into the Configuration Manager bin\X64 directory: adsource.dll and adsource_original.dll . The second file is intended to support DLL proxying, allowing the malicious replacement DLL to preserve expected functionality while avoiding a crash of the SMS_EXECUTIVE service. This is operationally significant because SMS Executive is a core Configuration Manag