CVE-2026-47301: Microsoft Configuration Manager Escalation

CVE-2026-47301 Overview

CVE-2026-47301 is an improper access control vulnerability [CWE-284] in Microsoft Configuration Manager. An authenticated attacker with low privileges can elevate privileges over a network without user interaction. The flaw affects multiple current branch releases including Configuration Manager 2503, 2509, and 2603.

Microsoft Configuration Manager, part of the Microsoft Endpoint Manager family, is widely deployed in enterprise environments to manage software distribution, patching, and device configuration. A successful attack against this component can compromise confidentiality, integrity, and availability of managed systems across the enterprise.

Critical Impact
An authenticated network attacker can elevate privileges within Microsoft Configuration Manager, potentially gaining administrative control over managed endpoints and the deployment infrastructure.

Affected Products

Microsoft Configuration Manager 2503
Microsoft Configuration Manager 2509
Microsoft Configuration Manager 2603

Discovery Timeline

2026-07-14 - CVE-2026-47301 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47301

Vulnerability Analysis

The vulnerability stems from improper access control within Microsoft Configuration Manager. The affected component fails to correctly enforce authorization checks before executing privileged operations requested over the network. An attacker who already holds low-privileged credentials on the network can invoke operations reserved for higher-privileged roles.

Because Configuration Manager coordinates software deployment, script execution, and configuration policy across managed endpoints, elevated access can be leveraged to reach systems beyond the initial foothold. Successful exploitation results in high impact to confidentiality, integrity, and availability of the Configuration Manager site.

The issue is classified under CWE-284 (Improper Access Control). Attack complexity is low, and no user interaction is required, which lowers the effort required for an authenticated adversary to weaponize the flaw.

Root Cause

The root cause is an authorization gap in a network-reachable interface exposed by Configuration Manager. Requests from authenticated users are processed without adequate validation of the caller's assigned role or scope, allowing operations to run in a higher privilege context than intended.

Attack Vector

Exploitation requires network access to the Configuration Manager site and valid low-privileged credentials. The attacker sends crafted requests to the vulnerable interface, triggering privileged actions such as configuration changes, deployment operations, or access to protected data. From that position, the attacker can pivot to managed clients or extract sensitive configuration data.

No verified public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft CVE-2026-47301 Advisory for technical specifics.

Detection Methods for CVE-2026-47301

Indicators of Compromise

Unexpected role changes, security scope modifications, or new administrative user assignments within the Configuration Manager console.
Unusual deployment, script execution, or client push activity originating from low-privileged accounts.
Anomalous authenticated requests to Configuration Manager SMS Provider or management point endpoints from non-administrative hosts.

Detection Strategies

Enable and forward Configuration Manager audit status messages and SMS Provider logs to a centralized SIEM for correlation.
Baseline normal administrative activity by account and site role, then alert on deviations such as privilege changes performed by non-admin identities.
Monitor Windows Security event logs on site servers for unusual authentication and privileged process execution patterns.

Monitoring Recommendations

Watch SMSProv.log, AdminService.log, and hman.log on the primary site server for unexpected privileged operations.
Alert on new package, application, task sequence, or script deployments targeting broad collections outside change windows.
Track modifications to Role-Based Administration assignments and security scopes in near real time.

How to Mitigate CVE-2026-47301

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-47301 Advisory to all Configuration Manager site servers and consoles.
Inventory all Configuration Manager sites running versions 2503, 2509, or 2603 and prioritize patching internet-facing or multi-tenant environments.
Review Role-Based Administration assignments and remove unnecessary access for low-privileged accounts.

Patch Information

Microsoft has issued guidance and updates through the Microsoft Security Response Center. Administrators should follow the vendor advisory at Microsoft CVE-2026-47301 Advisory to obtain the appropriate hotfix or in-console update for the deployed Configuration Manager version.

Workarounds

Restrict network access to Configuration Manager site systems using firewall rules so that only administrative subnets can reach the SMS Provider and AdminService endpoints.
Enforce multi-factor authentication and strong credential hygiene for all accounts with any Configuration Manager role.
Segment the site server from general user networks and audit service account permissions to remove excessive rights.

bash

# Configuration example: restrict access to the Configuration Manager AdminService (TCP 443)
# on the site server to a defined administrative subnet using Windows Firewall.
New-NetFirewallRule -DisplayName "ConfigMgr AdminService - Admins Only" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "ConfigMgr AdminService - Block Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443 `
  -Action Block