CVE-2025-59213: Configuration Manager Privilege Escalation

CVE-2025-59213 Overview

CVE-2025-59213 is an SQL injection vulnerability in Microsoft Configuration Manager that allows an unauthorized attacker to elevate privileges over an adjacent network. The flaw is categorized under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Microsoft Configuration Manager versions 2403, 2409, and 2503 are affected. The vulnerability requires no authentication and no user interaction, but the attacker must be positioned on an adjacent network segment to reach the vulnerable component.

Critical Impact

Successful exploitation gives an unauthenticated attacker on an adjacent network the ability to elevate privileges and compromise confidentiality, integrity, and availability of the Configuration Manager environment.

Affected Products

• Microsoft Configuration Manager 2403
• Microsoft Configuration Manager 2409
• Microsoft Configuration Manager 2503

Discovery Timeline

• 2025-10-14 - CVE-2025-59213 published to NVD
• 2026-02-13 - Last updated in NVD database

Technical Details for CVE-2025-59213

Vulnerability Analysis

The vulnerability stems from improper neutralization of special characters in SQL statements processed by Microsoft Configuration Manager. An attacker on an adjacent network can submit crafted input that is concatenated into a backend SQL query without proper sanitization or parameterization. The database engine then interprets attacker-controlled fragments as part of the query logic.

Because Configuration Manager runs with elevated database privileges to manage enterprise endpoints, successful injection allows the attacker to read, modify, or delete data inside the site database. The attack does not require valid credentials or user interaction. Exploitation is constrained to adjacent network access, meaning the attacker must reach the Configuration Manager site systems over a logically adjacent segment such as the same broadcast domain or VPN tunnel.

Root Cause

The root cause is the construction of SQL statements through unsafe string handling rather than parameterized queries or prepared statements. User-supplied values reach the SQL command parser without filtering of meta-characters such as single quotes, semicolons, and SQL keywords. This is a classic [CWE-89] pattern.

Attack Vector

An unauthenticated attacker on an adjacent network sends crafted requests to a Configuration Manager site role. The malicious input modifies the structure of a server-side SQL query, letting the attacker execute arbitrary statements within the database context. This yields privilege elevation across the managed environment. Microsoft has not published exploit details, and no public proof-of-concept code is available. Refer to the Microsoft CVE-2025-59213 Update Guide for vendor-supplied technical references.

Detection Methods for CVE-2025-59213

Indicators of Compromise

• Anomalous SQL statements in Configuration Manager site database transaction logs, including stacked queries, xp_cmdshell invocations, or UNION SELECT constructs.
• Unexpected creation or modification of administrative accounts and security roles within the Configuration Manager console.
• Outbound or lateral connections originating from Configuration Manager site systems to unmanaged hosts on adjacent network segments.

Detection Strategies

• Enable SQL Server auditing on the Configuration Manager site database and alert on syntactically unusual queries or schema changes.
• Monitor Configuration Manager component logs (smsexec.log, SMS_PROVIDER) for unexpected errors or sessions originating from non-administrative hosts.
• Deploy network signatures for SQL injection patterns targeting Configuration Manager ports and HTTP/HTTPS site role endpoints.

Monitoring Recommendations

• Baseline normal administrative traffic to site systems and alert on deviations from adjacent subnets.
• Correlate authentication, database, and Configuration Manager audit events through a centralized SIEM for cross-source visibility.
• Track privilege changes in the Configuration Manager RBAC_Admins and related tables and review them against change-management records.

How to Mitigate CVE-2025-59213

Immediate Actions Required

• Apply the Microsoft security update for Configuration Manager 2403, 2409, and 2503 as documented in the vendor advisory.
• Restrict network access to Configuration Manager site systems to known administrative subnets and management workstations.
• Audit Configuration Manager administrative accounts and database logins for unauthorized additions or privilege changes.

Patch Information

Microsoft has issued an official fix through the Microsoft CVE-2025-59213 Update Guide. Administrators should install the corresponding hotfix or in-console update for their Configuration Manager version. Verify the patch by checking the site server build number after installation.

Workarounds

• Segment Configuration Manager site systems on a dedicated management VLAN to eliminate adjacent-network exposure from general user subnets.
• Enforce IPsec or 802.1X authentication on management segments to block unauthenticated peers from reaching site role endpoints.
• Disable or firewall any unused Configuration Manager site role services until the patch is deployed.

# Example: restrict inbound access to Configuration Manager site server
# to a defined management subnet using Windows Firewall
New-NetFirewallRule -DisplayName "Allow ConfigMgr Mgmt Only" `
  -Direction Inbound `
  -Action Allow `
  -RemoteAddress 10.10.50.0/24 `
  -Protocol TCP `
  -LocalPort 1433,445,80,443,8530,8531

New-NetFirewallRule -DisplayName "Block ConfigMgr From Other Subnets" `
  -Direction Inbound `
  -Action Block `
  -Protocol TCP `
  -LocalPort 1433,445,80,443,8530,8531