Dateline: August 17, 2026
Picture the intern’s laptop. A regular Windows login, no special powers, the kind of account a company hands out by the thousand. Researchers at XM Cyber have shown that account is now enough to take over the single server that controls every managed Windows machine in the building. No stolen admin password. No malware dropped from the internet. Just four ordinary weaknesses stitched together, and one certificate that cost $58.
What Happened?
The target is Microsoft’s System Center Configuration Manager, better known as SCCM or ConfigMgr. It is the tool enterprises use to push software, patches, and settings across huge fleets of Windows machines. Microsoft cites more than 100 million active users. Compromise its primary site server and you inherit the keys to every endpoint underneath it.
The disclosed chain runs in four links. It starts with a broken permission check on the AdminService upload endpoint, which lets a standard Active Directory user smuggle in a malicious archive. A path-traversal flaw the researchers nicknamed “CabSlip” then lets files escape their sandbox and land elsewhere on the server.
Next comes the strange part: SCCM’s signature check only confirms that a file’s signature is structurally valid and unexpired. It never confirms the certificate belongs to Microsoft or to the organization, and revocation checks are switched off. So a cheap, commercially bought code-signing certificate sails right through. The final link loads a swapped-out library into a service running as NT AUTHORITY\SYSTEM, and the attacker gets top-level code execution.
Microsoft patched only the first link, tracked as CVE-2026-47301, back in July. The three remaining links stay open until the ConfigMgr 2609 release planned for October. The researchers noted the primary bypassed route is largely closed for standard users, though accounts holding the built-in Operations Administrator role can still reach the sequence through another path.
What’s the Impact?
This is the difference between one compromised laptop and a compromised company. As the researchers put it, once the site server falls, all of its managed clients fall with it, which usually means every asset in the estate.
SCCM is a distribution engine by design, so a foothold there is not a single breach; it is a delivery mechanism for pushing malicious code to thousands of machines at once. The low barrier makes it worse. The attacker needs a plain domain account and a certificate anyone can buy, not nation-state tooling. And the window stays open for months, with a full fix not expected until October.
How to Avoid This
Until the remaining patches land, defenders can shrink the exposure now.
- Restrict network access to the AdminService API so only trusted admin networks can reach it.
- Audit your SCCM RBAC assignments closely, especially the Operations Administrator role and any custom role with Create permission on SMS_ConsoleExtensionData.
- Watch the site server’s AdminService.log for a DirectoryNotFoundException followed by an HTTP 500, a pattern that can mean the path traversal fired.
- Flag any unexpected change to adsource.dll in the Configuration Manager install directory.
