PoC Exploit Released for Microsoft SCCM Vulnerability Enabling SYSTEM-Level Code Execution

A recently disclosed proof-of-concept (PoC) exploit for Microsoft Configuration Manager, previously known as System Center Configuration Manager (SCCM), demonstrates how an authenticated domain user could potentially escalate privileges to SYSTEM on a vulnerable Primary Site Server.

This issue, tracked as CVE-2026-47301, was reported by security researcher Omri Baso and is characterized as an exploit chain rather than a single isolated defect.

Microsoft SCCM Vulnerability

The exploit combines several vulnerabilities, including broken access control, a CAB archive extraction path traversal issue, a certificate verification bypass, and DLL hijacking. Together, these vulnerabilities allow the attacker to execute code in the highly privileged context used by Configuration Manager services.

According to the researcher’s technical description, the exploit exploits the software’s handling of extension-package content delivered in CAB format.

A specially crafted archive can write files outside the intended extraction location via a traversal sequence, allowing the attacker to place DLL files in the Configuration Manager installation’s bin\X64 directory. Importantly, this technique is path-independent, meaning the attacker does not need to know the specific directory selected during SCCM installation.

This aspect heightens the risk for organizations that believe non-default deployment paths provide significant protection against exploitation attempts.

The attack chain relies on DLL hijacking involving the adsource.dll library, which is loaded by the SCCM Executive service (SMS_EXECUTIVE). Baso’s PoC includes a proxy-DLL mechanism designed to preserve normal service behavior while the malicious component executes.

Because the targeted service operates with SYSTEM-level privileges, successful exploitation could grant an attacker complete control over the compromised Primary Site Server.

In enterprise environments, such servers typically manage software deployment, endpoint configurations, operating system deployment workflows, and other critical infrastructure functions, making them high-value targets for lateral movement.

The public PoC also claims that a low-privilege domain account can identify potential Primary Site Server candidates by examining access control entries associated with Active Directory’s System Management container.

SCCM site servers usually maintain permissions over this location to publish and manage configuration data. Although the server name may not be directly exposed through an Active Directory query, the repository suggests that permissions assigned to machine accounts can help an attacker deduce the relevant server.

Consequently, security teams should treat unusual directory permission enumeration and reconnaissance around SCCM-related Active Directory objects as suspicious, especially when conducted by accounts without administrative roles.

The researcher’s demonstration payload modifies the built-in RID 500 local Administrator account and records changes on the affected server.

While this behavior is specific to the PoC, it illustrates the severity of SYSTEM-level access: an attacker could alternatively deploy remote-access tools, manipulate SCCM packages, harvest credentials, turn off security controls, or distribute malicious content to managed endpoints.

The repository includes a compiled release and a signed CAB file, which increases the urgency for security teams to verify their exposure and monitor for any exploitation attempts.

Organizations using Microsoft Configuration Manager should immediately review Microsoft’s advisory and apply any available security updates or mitigations for CVE-2026-47301.

Until remediation is confirmed, defenders should restrict access to SCCM infrastructure, audit modifications in SCCM binary directories, investigate unexpected DLL loads by SMS_EXECUTIVE, and monitor for unusual CAB package processing.

Additionally, security teams should inspect Active Directory permissions on the System Management container to ensure that only legitimate SCCM site-server accounts retain elevated rights.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world