{"id":9124,"date":"2026-08-13T12:14:45","date_gmt":"2026-08-13T12:14:45","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9124"},"modified":"2026-08-13T12:14:45","modified_gmt":"2026-08-13T12:14:45","slug":"it-took-58-to-break-microsofts-sccm-but-a-patch-made-it-harder","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9124","title":{"rendered":"It took $58 to break Microsoft\u2019s SCCM, but a patch made it harder"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Researchers at XM Cyber found that a standard domain user with no Microsoft SCCM privileges can chain multiple flaws to reach remote code execution, although the attack does require network access to the SCCM environment.<\/p>\n

Enterprises use Microsoft System Center Configuration Manager (SCCM<\/a>) to deploy operating systems, manage patches, distribute software, and monitor compliance across large Windows fleets. XM Cyber\u2019s attack can move from an ordinary domain account to code execution as \u201cNT AUTHORITYSYSTEM\u201d on the primary site server.<\/p>\n

\u201cAfter the Site Server is compromised, all of its managed clients are compromised as well, which usually means taking over all the company assets,\u201d XM Cyber\u2019s Omri Baso<\/a> told CSO.<\/p>\n

The revealed attack chain combines four weaknesses, including a broken authorization in the AdminService upload functionality, a path-traversal flaw dubbed \u201cCabSlip,\u201d weak code-signing validation that could be tricked with a $58 commercial certificate, and an unsigned DLL-loading path in the SMS Executive service.<\/p>\n

Microsoft fixed the initial authorization flaw, tracked as CVE-2026-47301<\/a>, in July, but Baso said the remaining links in the chain are not expected to be fully addressed until ConfigMgr 2609, planned for October.<\/p>\n

<\/a>The patch did not patch<\/h2>\n

The initial foothold comes from SCCM\u2019s AdminService API. Its normal extension-upload endpoint checks whether a user has the required permission, but its \u201cchunked-upload\u201d counterpart does not. That allows an authenticated Active Directory user to submit a malicious CAB archive without SCCM administrative privileges.<\/p>\n

Microsoft\u2019s July fix blocks that route for standard domain users. However, the downstream chain remains reachable through another path. Users assigned the built-in Operations Administrator role, or a custom role with Create permission on \u201cSMS_ConsoleExtensionData,\u201d can still trigger the same sequence.<\/p>\n

But there is an important qualification here. XM Cyber said it believes organizations are unlikely to be exposed through the Operations Administrator route because it is already a highly privileged role.<\/p>\n

Once the CAB reaches the server, CabSlip allows files to escape the intended temporary extraction directory and be written elsewhere on the filesystem. The attacker can use this arbitrary file-write capability to replace \u201cadsource.dll,\u201d a secondary library loaded by the SYSTEM-level SMS Executive service without its own signature check.<\/p>\n

When the service subsequently loads the DLL, the attacker gets code execution as SYSTEM.<\/p>\n

<\/a>A $58 certificate can cross the trust boundary<\/h2>\n

The chain becomes particularly notable because SCCM\u2019s signature validation does not establish that the signing certificate belongs to Microsoft or the target organization. It checks that the signature is structurally valid and non-expired, while revocation checks are disabled.<\/p>\n

That means an attacker does not need an enterprise certificate. XM Cyber said the attack depends on a code-signing certificate and can also abuse certificates leaked online. For his own research, Baso used a Certum Open Source Developer Certificate that cost about $58.<\/p>\n

For defenders, XM Cyber recommends restricting network access to the AdminService API and auditing SCCM RBAC<\/a> assignments, particularly accounts with the Operations Administrator role or equivalent Create permissions.<\/p>\n

Teams should also monitor the Site Server\u2019s \u201cAdminService.log\u201d for a \u201cSystem.IO.DirectoryNotFoundException\u201d followed by an HTTP 500 response, a pattern that can indicate the path traversal was triggered, XM Cyber added.<\/p>\n

Unexpected modifications to adsource.dll in the Configuration Manager installation directory can provide another detection signal.<\/p>\n

Microsoft is reportedly working on patches for the remaining flaws. It did not immediately respond to CSO\u2019s request for comment.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Researchers at XM Cyber found that a standard domain user with no Microsoft SCCM privileges can chain multiple flaws to reach remote code execution, although the attack does require network access to the SCCM environment. Enterprises use Microsoft System Center Configuration Manager (SCCM) to deploy operating systems, manage patches, distribute software, and monitor compliance across […]<\/p>\n","protected":false},"author":0,"featured_media":9125,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9124","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9124"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9124"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9124\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9125"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}