CVE-2026-88075

Summary

This CVE describes a SQL injection vulnerability in Microsoft Configuration Manager that allows authenticated attackers to execute arbitrary SQL commands and elevate their privileges across the network. The flaw occurs when user-supplied input is not properly sanitized before being used in SQL queries.

Exploitability

Exploitation requires an authenticated user account with access to Configuration Manager, making it moderately difficult but possible to achieve privilege escalation through crafted SQL injection payloads.

Blast radius

If exploited, this vulnerability could allow attackers to gain full administrative control over Configuration Manager instances, potentially leading to widespread compromise of managed devices and systems across the enterprise network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Microsoft Configuration Manager version 2503.1 or later, as this is the first fixed version mentioned in the CVE description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.