CVE-2026-47301PoC(microsoft / configuration_manager_2503)

HIGHCVSS 8.8 · HIGH

Exploitation observed; activity peaked at 4 mentions and remains active

Immediate actions

Patch microsoft configuration_manager_2503 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

microsoft CVEs Back to dashboard

7.8/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47301

Weakness type (CWE)

CWE-284

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

configuration_manager_2503
configuration_manager_2509
configuration_manager_2603

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
22 mentions across 11 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 10 signals
PoC mentioned or linked in 16 signals
Patch or workaround mentioned in 12 signals
Technical details provided in 20 signals
Peaked 8d ago at 4 mentions (2026-08-14); latest day: 1
22 total mentions across 11 days

Affected systems

Vendors

microsoft

Products

configuration_manager_2503configuration_manager_2509configuration_manager_2603

1 version affected across 3 products

Deep dive

Activity timeline22 mentions / 11d

Signal classification4 categories

PoC

1045.5%

Patch

731.8%

Exploit

418.2%

Disclosure

14.5%

Referenced assets15 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	1	Patch1
2026-08-13	1	Patch1
2026-08-14	4	Patch1PoC3
2026-08-15	1	Patch1
2026-08-16	3	Exploit2Patch1
2026-08-18	2	PoC2
2026-08-19	2	PoC2
2026-08-20	4	Exploit1Patch1PoC2
2026-08-25	2	Disclosure1Patch1
2026-08-26	1	PoC1
2026-09-01	1	Exploit1

Full discourse20 posts

ThreatWire@ThreatWire_61d
PoC
🚨 PoC RELEASED: Public exploit code is now available for CVE-2026-47301, a CVSS 8.8 privilege escalation flaw in Microsoft Configuration Manager (SCCM). The vulnerability involves improper access control and can be exploited over the network by an authorized attacker. Researchers also linked the flaw to a broader SCCM exploit chain capable of escalating from a domain user to SYSTEM-level code execution on the primary site server. 🔗 https://github.com/omribaso/sccm-cve-2026-47301-remote-code-execution-exploit #Microsoft #SCCM #CVE #PoC #CyberSecurity #Windows #Infosec
Post summary
The post announces a publicly available PoC and exploit code for CVE‑2026‑47301, detailing its privilege‑escalation capabilities and providing a GitHub link for reference.
074121913031.1K
1.7K followersView on X
Co11ateral@co11ateral58d
Exploit
SCCM - Remote Code Execution (CVE-2026-47301) Exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-write path traversal, certificate verification bypass, and DLL hijacking to achieve SYSTEM-level code execution https://github.com/OmriBaso/SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit
Post summary
The post announces a full exploit chain for CVE-2026-47301, providing a GitHub PoC and detailed technical description of RCE vectors, with no evidence of current real‑world exploitation.
0280107585.9K
12.3K followersView on X
Rıdvan Yağlı@ridvanyagli60d
PoC
🔴 Microsoft SCCM (ConfigMgr) CVE-2026-47301 – CVSS 8.8 Privilege Escalation PoC (RCE) Yayınlandı! Bu açık, SCCM'de özel yetkisi olmayan sıradan bir domain kullanıcısının, primary site server üzerinde SYSTEM seviyesinde kod çalıştırma yetkisine yükselmesine olanak tanıyor. Microsoft Temmuz 2026'da giriş noktasını yamaladı, ancak zincirin kalan kısımları Ekim 2026'daki ConfigMgr 2609'a kadar tam kapanmamış durumda. https://github.com/omribaso/sccm-cve-2026-47301-remote-code-execution-exploit
Post summary
A Proof of Concept for CVE‑2026‑47301, enabling domain users to gain SYSTEM RCE on SCCM servers, has been released; Microsoft patched the main entry point in July 2026, though full mitigation isn’t achieved until later.
021076423.8K
2.4K followersView on X
Chris Thompson@_Mayyhem61d
Patch
Patch SCCM with https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2603/38232642 or you're likely vulnerable to a new hierarchy takeover technique (CVE-2026-47301) discovered by Omri Baso from @XMCyber_ that worked in my lab out of the box. MS's KB description doesn't do the impact justice. https://medium.com/@omribaso/from-domain-user-to-enterprise-control-microsoft-configuration-manager-rce-0-day-exploit-chain-393c63c680ca
Post summary
The post highlights that SCCM users should apply a Microsoft hotfix to mitigate CVE-2026-47301, an identified hierarchy takeover flaw, and provides a Medium article with additional details, but no active exploitation or specific exploit code is described.
025063285.3K
2.8K followersView on X
Blackstorm Security@blackstormsecbr55d
Exploit
SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit https://github.com/OmriBaso/SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit #exploit #vulnerability #windows #microsoft #cybersecurity #informationsecurity https://t.co/3SU25LR1Uw
Post summary
The post shares a GitHub repository containing a functional exploit that achieves remote code execution on SCCM for CVE‑2026‑47301, with no indication of active attacks or available patches.
05016171.6K
2.4K followersView on X
dbugs@ptdbugs61d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-47301 Vendor: Microsoft Product: Microsoft Configuration Manager Description: Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. Link: https://github.com/omribaso/sccm-cve-2026-47301-remote-code-execution-exploit #dbugs_vuln
Post summary
The post announces a discovered proof‑of‑concept exploit for CVE‑2026‑47301 in Microsoft Configuration Manager, providing a GitHub link to the remote code execution code.
1201561.4K
3.6K followersView on X
Daily CyberSecurity@Daily_CyberSec55d
PoC
A public PoC for CVE-2026-47301 chains SCCM flaws to reach SYSTEM-level code execution from a plain domain user. Details and exploit code are disclosed. #CVE202647301 #SCCM #ConfigurationManager #PrivilegeEscalation #SYSTEM #PoCExploit https://securityonline.info/cve-2026-47301-sccm-system-rce/
Post summary
The post announces a public PoC and disclosed exploit code for CVE‑2026‑47301 that chains SCCM flaws to achieve SYSTEM-level execution from a plain domain user, with no mention of patches or active exploitation.
00042490
13.0K followersView on X
lee1981@lee1981b57d
PoC
🔥 CyberForge CVE of the Day #027 🚨 CVE-2026-47301 — Microsoft Configuration Manager (SCCM/ConfigMgr) contains a High-severity access-control flaw that can let a low-privilege domain user reach SYSTEM on the Primary Site Server. 🔑 Key details: ⭐ Severity: High — CVSS 8.8 🔐 Authentication: Low-privilege domain account 🌐 Attack vector: Network 🙅 User interaction: None 🧩 Weakness: CWE-284 💥 Impact: Privilege escalation / researcher-demonstrated RCE as SYSTEM 🧪 Public PoC: Available 🧨 Researcher-demonstrated chain AdminService authorisation gap ➡️ Crafted console-extension CAB ➡️ CAB path traversal ➡️ Researcher-described validation weakness ➡️ adsource.dll hijacking ➡️ SYSTEM execution ⚠️ Important correction: The public repository was created on 3 August and updated through 16 August—it did not first appear today. Microsoft already provides fixes for ConfigMgr 2503, 2509 and 2603. The claim that the remainder arrives in October/2609 is currently unconfirmed; Microsoft’s published cadence places 2609 in September. ✅ Fixed-build thresholds: • 2503: 5.0.9135.1031+ • 2509: 5.0.9141.1030+ • 2603: 5.0.9146.1021+ 🛡️ Defender action: Patch now, verify actual build numbers, restrict AdminService to trusted management networks, audit ConfigMgr RBAC and extension imports, disable unsigned extensions unless essential, and hunt for suspicious AdminService uploads or changes to adsource.dll. 📍- No confirmed exploitation in the wild found 📍- Not currently listed in CISA KEV 📍- Do not wait for ConfigMgr 2609 🔗 Public research and PoC details: https://github.com/OmriBaso/SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit 🔗 Full vulnerability details: https://nvd.nist.gov/vuln/detail/CVE-2026-47301 #CyberSecurity #CVE #Microsoft #SCCM #ConfigMgr #CyberForge
Post summary
CVE-2026-47301 is a high‑severity privilege escalation flaw in Microsoft SCCM with a publicly available PoC and exploit chain; patches are released, recommended mitigation steps are provided, and no wild exploitation has been reported.
10032287
634 followersView on X
The Javvad Malik A.I.@J4vv4D60d
Patch
SCCM sits in your infrastructure like a master key. One HTTP POST from literally anyone in your domain and an attacker owns the whole thing. Patch CVE-2026-47301 now. ... https://api.cyfluencer.com/s/potential-for-remote-code-execution-in-microsoft-sccm-via-newly-discovered-exploit-chain-28995 https://cdn.bsky.app/img/avatar_thumbnail/plain/did:plc:mm224rta5df2vmclvdrcc6c5/bafkreig7xqsbanbt3gsuosnhpr7j6wmybqquxouemjcen2zxuac6nakgqe
Post summary
CVE-2026-47301 is reported to allow complete takeover of SCCM via a simple HTTP POST, with a direct call to patch the vulnerability and an accompanying link to an exploit chain.
00015389
15.9K followersView on X
!Manan@0xManan43d
Exploit
New public chain for Microsoft Configuration Manager (SCCM), CVE-2026-47301. Broken access control, CAB path traversal, certificate verification bypass, and DLL hijacking chained to SYSTEM. If your org still uses SCCM to push software and configs, this is not a niche CVE. It is a path from the management server to domain-wide compromise. https://github.com/OmriBaso/SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit
Post summary
CVE‑2026‑47301 presents a chain of access‑control and traversal flaws that enables domain‑wide compromise of Microsoft SCCM, with a PoC/exploit repository publicly available on GitHub.
00021304
2.2K followersView on X
Lorenzo Ordóñez@lordman198250d
Disclosure
CVE-2026-47301: de una simple elevación de privilegios en SCCM a ejecución como SYSTEM https://www.hackplayers.com/2026/08/cve-2026-47301-no-es-una-simple-elevacion.html
Post summary
The text announces CVE-2026-47301, describing a privilege‑escalation flaw in SCCM that permits execution as SYSTEM, but provides no PoC, exploit code, patch information, or evidence of active exploitation.
0001168
1.6K followersView on X
Cyber Kendra@cyberkendra58d
Patch
SCCM CVE-2026-47301: Microsoft patched the flaw — but only 1 of the 4 links in the RCE chain. The path to SYSTEM on your Primary Site Server is still open. Read Details - https://www.cyberkendra.com/2026/08/microsofts-sccm-hotfix-fixes-only-one.html #microsoft #hotfix #security #update https://t.co/5bcYs8lC1l
Post summary
Microsoft issued a patch for CVE-2026-47301 that covers only one link in the RCE chain, leaving the SYSTEM path on Primary Site Servers still vulnerable.
00020118
1.5K followersView on X
StemShop@stem__shop56d
PoC
🚨 CVE-2026-47301 — Microsoft SCCM Vulnerability CVSS 8.8 • Low privileges • No user interaction • Public PoC available • Attack chain can lead to SYSTEM code execution. https://stemshop.top/blog/cve-2026-47301-microsoft-sccm-rce.php #CVE #CVE202647301 #Microsoft #SCCM #RCE #CyberSecurity #InfoSec #PoC
Post summary
The tweet announces CVE-2026-47301, provides technical details (CVSS 8.8, low privileges, no user interaction), and explicitly states a public PoC is available, while denying active exploitation, named exploit tools, and patch availability.
000106
8 followersView on X
Pierson-Tech@Pierson_Tech56d
PoC
@lee1981b Thank you @lee1981b for drawing attention to this. The combination of low-privilege domain access, a network-reachable path to SYSTEM, and a public PoC makes CVE-2026-47301 one ConfigMgr teams should act on now. Verify the installed build; do not assume the update is in place.
Post summary
CVE‑2026‑47301 has a public Proof of Concept that shows low‑privilege domain access can reach SYSTEM; ConfigMgr teams should verify their builds and apply the available patch.
0001071
56 followersView on X
iototsecnews@iototsecnews49d
PoC
Microsoft SCCM の脆弱性 CVE-2026-47301：SYSTEM レベルのコード実行の PoC が登場 https://iototsecnews.jp/2026/08/18/poc-exploit-released-for-microsoft-sccm-vulnerability-enabling-system-level-code-execution/ Microsoft Configuration Manager (旧称 SCCM) における特権昇格の危険性について解説する記事です。低権限のユーザーであっても、システム制御権を取得できる脆弱性 CVE-2026-47301 が確認されています。アクセス制御の不備／パス・トラバーサル／証明書検証の回避／ DLL ハイジャックという複数の欠陥が連鎖することで SYSTEM 権限での不正実行に繋がります。広範な管理機能を持つ基盤が乗っ取られた場合、インフラ全体への悪意のある配信や不正アクセス等の重大な被害を生じさせます。解決に向けてはセキュリティ更新プログラムの迅速な適用／関連バイナリ監視／権限管理の厳格化などの包括的な運用調整が強く求められます。 #ConfigurationManager #CVE202647301 #Microsoft #PoC #SCCM #Vulnerability
Post summary
The article reports that a PoC demonstrating system‑level code execution via multiple defects in Microsoft SCCM (CVE‑2026‑47301) has been released, and it advises applying security updates and strengthening monitoring.
00000167
510 followersView on X
iototsecnews@iototsecnews50d
Patch
Microsoft SCCM の脆弱性 CVE-2026-47301：7月の Patch Tuesday 後も攻撃チェーンに未修正の弱点が残る RCE https://iototsecnews.jp/2026/08/17/microsoft-sccm-vulnerability-chained-to-execute-malicious-code-remotely/ Microsoft System Center Configuration Manager (SCCM) に存在する CVE-2026-47301 などの複数の問題を悪用する攻撃者が、特権のないドメイン・アカウントからシステム最高権限を奪取するリスクが判明しています。この件は構成情報の管理機能や認証／検証プロセスの隙を突いた攻撃手法であり、管理サーバの不正操作／マルウェアの配置／システム全体への感染拡大／被害組織の完全な制御といった影響を及ぼします。一時的な対応策として AdminService ログの監視／ "adsource.dll" の変更検知／アクセス制限／ロール割り当ての見直しを実施した上で、10 月に予定されている修正の適用が求められます。 #CVE202647301 #Microsoft #SCCM #SystemCenterConfigurationManager #Vulnerability
Post summary
The post highlights a CVE‑2026‑47301 vulnerability in Microsoft SCCM that enables remote code execution and privilege escalation, outlines temporary mitigations, and states a patch will be released in October.
00000175
510 followersView on X
Upwind Security MDR@UpwindMDR54d
Patch
🚨High - SCCM AdminService RBAC bypass allows unprivileged CAB extension uploads (CVE-2026-47301) UploadExtensionInChunks omits the CheckAccess(Guid.Empty, 1024) call its sibling endpoint enforces, so any authenticated AD user with no SCCM role can POST chunked .cab console extensions. Entry point of a four-link chain to SYSTEM (path traversal → signing bypass → DLL load); Microsoft patched only this link, rest open until ConfigMgr 2609 (Oct 2026). 👉Affected: Microsoft ConfigMgr/SCCM | Apply the July 2026 update
Post summary
CVE-2026-47301 is a high‑severity SCCM AdminService RBAC bypass enabling unauthenticated AD users to upload CAB extensions, leading to SYSTEM privileges. Microsoft has issued a patch in the July 2026 update and urges immediate deployment.
0000055
292 followersView on X
r1cksec@r1cksec55d
PoC
PoC exploit chain (CVE-2026-47301) for SCCM, combining a broken access, CAB arbitrary-write path traversal, certificate verification bypass, and DLL hijacking to achieve SYSTEM-level code execution. https://github.com/OmriBaso/SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit #infosec #cybersecurity #pentest #cve #redteam
Post summary
The post announces a Proof of Concept exploit chain for CVE-2026-47301, provides a GitHub link to the exploit code, and details technical aspects of the vulnerability while lacking evidence of active exploitation or patches.
00000150
1.2K followersView on X
The Daily Tech Feed@dailytechonx57d
PoC
A PoC exploit for CVE-2026-47301 in Microsoft SCCM has been released, allowing attackers to execute code with SYSTEM privileges on Primary Site Servers. Organizations must apply security updates immediately to mitigate this critical risk. #Security #Microsoft #SCCM #CVE202647301 #CyberSecurity #PatchNow https://thedailytechfeed.com/exploit-released-for-critical-microsoft-sccm-vulnerability/
Post summary
A proof‑of‑concept exploit for CVE‑2026‑47301 has been released, enabling SYSTEM‑level code execution on Microsoft SCCM Primary Site Servers, and organizations are urged to apply security updates immediately.
0000092
645 followersView on X
🇺🇸 Martin Reyes 🇩🇴@MartinReyes4058d
Exploit
Public exploit code is now available for CVE-2026-47301, a CVSS 8.8 privilege escalation flaw in Microsoft Configuration Manager (SCCM).
Post summary
Public exploit code for the CVE-2026-47301 privilege‑escalation vulnerability in Microsoft SCCM has been released, but there is no indication of current active exploitation or patch availability.
0000083
606 followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	configuration_manager_2503	-	-	-
App	microsoft	configuration_manager_2509	-	-	-
App	microsoft	configuration_manager_2603	-	-	-

Explore more

Back to dashboard microsoft CVEs configuration_manager_2503 vulnerabilities

What researchers are saying

CVE-2026-47301

ThreatWire[verified]@ThreatWire_PoC

The post announces a publicly available PoC and exploit code for CVE‑2026‑47301, detailing its privilege‑escalation capabilities and providing a GitHub link for reference.

Co11ateral[verified]@co11ateralExploit

The post announces a full exploit chain for CVE-2026-47301, providing a GitHub PoC and detailed technical description of RCE vectors, with no evidence of current real‑world exploitation.

Rıdvan Yağlı[verified]@ridvanyagliPoC

A Proof of Concept for CVE‑2026‑47301, enabling domain users to gain SYSTEM RCE on SCCM servers, has been released; Microsoft patched the main entry point in July 2026, though full mitigation isn’t achieved until later.

dbugs[verified]@ptdbugsPoC

The post announces a discovered proof‑of‑concept exploit for CVE‑2026‑47301 in Microsoft Configuration Manager, providing a GitHub link to the remote code execution code.

lee1981[verified]@lee1981bPoC

CVE-2026-47301 is a high‑severity privilege escalation flaw in Microsoft SCCM with a publicly available PoC and exploit chain; patches are released, recommended mitigation steps are provided, and no wild exploitation has been reported.

!Manan[verified]@0xMananExploit

CVE‑2026‑47301 presents a chain of access‑control and traversal flaws that enables domain‑wide compromise of Microsoft SCCM, with a PoC/exploit repository publicly available on GitHub.

Pierson-Tech[verified]@Pierson_TechPoC

CVE‑2026‑47301 has a public Proof of Concept that shows low‑privilege domain access can reach SYSTEM; ConfigMgr teams should verify their builds and apply the available patch.

Upwind Security MDR[verified]@UpwindMDRPatch

CVE-2026-47301 is a high‑severity SCCM AdminService RBAC bypass enabling unauthenticated AD users to upload CAB extensions, leading to SYSTEM privileges. Microsoft has issued a patch in the July 2026 update and urges immediate deployment.