CVE-2024-43468 Microsoft Configuration Manager SQL Injection Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-89

Description

Microsoft Configuration Manager Remote Code Execution Vulnerability

Affected products and versions

Product	Affected versions	Fixed in
Microsoft Configuration Manager 1.0	1.0.0 → < 5.00.9106	5.00.9106

Other CVEs of Microsoft Configuration Manager

The 9 CVEs of Microsoft Configuration Manager →

CVE-2026-88075 Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration… 8.8 High CVE-2026-70049 Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration… 8.0 High CVE-2026-47301 Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a… 8.8 High CVE-2025-47179 Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally 6.7 Medium