CVE-2026-88075: Microsoft Configuration Manager SQLi Flaw

CVE-2026-88075 Overview

CVE-2026-88075 is a SQL injection vulnerability in Microsoft Configuration Manager. The flaw stems from improper neutralization of special elements used in an SQL command [CWE-89]. An authenticated attacker can exploit the weakness over a network to elevate privileges within the Configuration Manager environment.

Microsoft published the advisory through the Microsoft Security Response Center (MSRC). Successful exploitation can compromise the confidentiality, integrity, and availability of the Configuration Manager site database. Because Configuration Manager coordinates software deployment and configuration across managed endpoints, privilege escalation here can cascade into broader enterprise impact.

Critical Impact
Authenticated network attackers can inject SQL commands to elevate privileges within Microsoft Configuration Manager, gaining control over the site database and connected managed devices.

Affected Products

Microsoft Configuration Manager (refer to the Microsoft CVE-2026-88075 Update Guide for affected build numbers)
Deployments using the Configuration Manager site database
Environments where low-privileged users can authenticate to Configuration Manager interfaces

Discovery Timeline

2026-10-13 - CVE-2026-88075 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-88075

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] in Microsoft Configuration Manager. Input passed to one or more SQL command paths is not neutralized before being concatenated into database queries. An attacker who already holds low-level authenticated access can submit crafted input that alters the structure of the resulting SQL statement.

Successful injection lets the attacker read, modify, or delete data stored in the Configuration Manager site database. Because Configuration Manager uses this database to drive package distribution, task sequences, and client policy, control of the database translates to control of managed endpoints. The attacker can read secrets, modify deployment definitions, or escalate account privileges inside the Configuration Manager role model.

The attack is executed across the network against the Configuration Manager service surface. No user interaction is required, and attack complexity is low once valid credentials are available.

Root Cause

The root cause is missing or inadequate parameterization of user-supplied input before it is used in SQL statements. Code paths accept input that should have been bound through parameterized queries or stored procedure parameters. Instead, special SQL metacharacters pass through to the query executor and are interpreted as command syntax.

Attack Vector

The attacker must authenticate to Configuration Manager with at least a low-privileged role. From an authenticated session, the attacker submits requests containing SQL metacharacters through a vulnerable Configuration Manager interface reachable over the network. The injected payload executes against the site database with the privileges of the Configuration Manager service account, enabling privilege escalation beyond the attacker's original role.

No verified public proof-of-concept exploit code is available at the time of publication. Technical details are described in prose because no sanitized exploitation code has been released by Microsoft or third-party researchers. Review the Microsoft CVE-2026-88075 Update Guide for vendor-provided technical details.

Detection Methods for CVE-2026-88075

Indicators of Compromise

Unexpected SQL error messages or syntax errors in Configuration Manager logs such as smsprov.log, SMS_Admin_UI.log, and SQL Server error logs.
Unusual queries against the Configuration Manager site database originating from the Configuration Manager service account, especially queries referencing system tables or role membership.
New or modified Configuration Manager administrative role assignments that do not correspond to a change ticket.

Detection Strategies

Enable SQL Server auditing on the Configuration Manager site database and alert on UNION, xp_cmdshell, or stacked statements originating from application sessions.
Baseline normal query patterns from the Configuration Manager provider and alert on deviations in query shape, length, or table targets.
Correlate authentication events for low-privileged Configuration Manager accounts with subsequent privilege or role changes within short time windows.

Monitoring Recommendations

Forward Configuration Manager and SQL Server logs to a centralized analytics platform for retention and correlation.
Monitor outbound connections from the site database server, which should normally be constrained to management traffic.
Review Configuration Manager role-based administration audit logs daily during the exposure window.

How to Mitigate CVE-2026-88075

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-88075 Update Guide as soon as it is available for your Configuration Manager version.
Audit Configuration Manager role assignments and remove accounts that do not require administrative access.
Rotate credentials for Configuration Manager service accounts and any SQL logins associated with the site database if compromise is suspected.

Patch Information

Microsoft has published guidance for CVE-2026-88075 through MSRC. Administrators should consult the Microsoft CVE-2026-88075 Update Guide to identify the correct cumulative update or hotfix for their Configuration Manager current branch version and apply it to all site servers.

Workarounds

Restrict network access to Configuration Manager administrative endpoints using firewall rules and segmentation so that only trusted administrative hosts can authenticate.
Enforce least privilege on Configuration Manager role-based administration, limiting the pool of accounts that can reach vulnerable code paths.
Enable SQL Server auditing and alert on anomalous query patterns against the Configuration Manager site database until patching is complete.

bash

# Configuration example: restrict inbound access to the Configuration Manager site server
# Replace <AdminSubnet> with the subnet authorized to manage Configuration Manager.
New-NetFirewallRule -DisplayName "ConfigMgr Admin Access" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 443,445,1433 `
  -RemoteAddress <AdminSubnet> `
  -Action Allow