SQL Injection Vulnerability in Microsoft Configuration Manager by Microsoft
CVE-2026-88075

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Configuration Manager
Microsoft Configuration Manager 2509
Microsoft Configuration Manager 2603
Vendor
CVE Published:
13 October 2026

What is CVE-2026-88075?

An SQL injection vulnerability exists in Microsoft Configuration Manager, enabling an attacker with authorized access to manipulate SQL commands. This flaw may allow the attacker to escalate privileges and gain unauthorized access to sensitive information across the network. It underscores the importance of implementing proper input validation and security measures to prevent such vulnerabilities and protect network integrity.

Affected Version(s)

Microsoft Configuration Manager 1.0.0 < 5.00.9135.1040

Microsoft Configuration Manager 2509 1.0.0 < 5.00.9141.1039

Microsoft Configuration Manager 2603 1.0.0 < 5.00.9146.1026

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.