Microsoft SCCM Vulnerability Chained to Execute Malicious Code Remotely
Brief
Security researchers have disclosed a serious attack chain affecting Microsoft System Center Configuration Manager , commonly known as SCCM or Configuration Manager.
The flaws could allow an attacker to execute malicious code remotely on an SCCM primary site server, potentially taking control of an organization’s managed Windows environment.
The attack is especially concerning because a standard Active Directory domain user could start the original chain. The account does not need SCCM administrative permissions, elevated Windows privileges, or user interaction.
A successful attack targets the SCCM primary site server, a critical system responsible for software deployment, patching, operating system installation, compliance monitoring, and device management.
Microsoft SCCM Vulnerability
XM Cyber reported the vulnerabilities to Microsoft on May 23.