CVE-2024-43468

Published Oct 8, 2024

Last updated a month ago

Exploit known CVSS critical 9.8

Microsoft

SCCM

Server

SQL injection

Overview

Description: Microsoft Configuration Manager Remote Code Execution Vulnerability
Source: secure@microsoft.com
NVD status: Analyzed
Products: configuration_manager_2403, configuration_manager_2409, configuration_manager_2503

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Microsoft Configuration Manager SQL Injection Vulnerability
Exploit added on: Feb 12, 2026
Exploit action due: Mar 5, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@microsoft.com: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:configuration_manager_2403:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "AA84B441-EDC4-4871-AB6D-CDD3C638F5D0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:configuration_manager_2409:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "3832F552-1DE3-49A3-8B2B-C75C0D404279",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:configuration_manager_2503:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "F476484B-C570-4389-A9D1-B6AE2B1C11F9",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References