Researchers Chain Four Flaws to Break Microsoft SCCM for $58

Security researchers have discovered an exploit chain that allows a standard domain user with no privileges to gain complete control over Microsoft's System Center Configuration Manager (SCCM), using only a $58 commercial code-signing certificate. XM Cyber published the findings, revealing that attackers can escalate from an ordinary Active Directory account to remote code execution as "NT AUTHORITY\SYSTEM" on the primary site server. Since enterprises rely on SCCM to deploy operating systems, manage patches, distribute software, and monitor compliance across large Windows fleets, compromising it means taking over potentially all company assets.

The attack combines four separate weaknesses to reach its goal. The first involves broken authorization in SCCM's AdminService upload functionality, where the "chunked-upload" endpoint fails to verify whether users hold required permissions, unlike its normal extension-upload counterpart. Second, a path-traversal vulnerability called "CabSlip" lets files escape their intended temporary extraction directory and land elsewhere on the filesystem. Third, weak code-signing validation accepts any structurally valid, non-expired signature without confirming the certificate belongs to Microsoft or the target organization, while revocation checks remain disabled. Fourth, an unsigned DLL-loading path in the SMS Executive service allows arbitrary code execution when a malicious library replaces "adsource.dll," a secondary file the SYSTEM-level service loads without signature verification. Microsoft addressed the initial authorization flaw, tracked as CVE-2026-47301, in July, but the remaining chain components aren't expected to be fully patched until ConfigMgr 2609, planned for October.

According to XM Cyber's Omri Baso, "After the Site Server is compromised, all of its managed clients are compromised as well, which usually means taking over all the company assets." Microsoft's July patch blocks the route for standard domain users, but the downstream chain remains accessible through another path. Users assigned the built-in Operations Administrator role, or a custom role with Create permission on "SMS_ConsoleExtensionData," can still trigger the same sequence, though XM Cyber believes organizations are unlikely to be exposed through this route since it's already a highly privileged role. For his research, Baso used a Certum Open Source Developer Certificate costing approximately $58, though the attack can also abuse certificates leaked online.

The chain becomes especially concerning because SCCM's signature validation doesn't establish certificate ownership at all. It merely confirms the signature is structurally sound and hasn't expired, meaning attackers don't need an enterprise certificate to cross the trust boundary. Once the malicious CAB archive reaches the server, CabSlip's path-traversal capability lets attackers write files anywhere on the filesystem, enabling them to swap out "adsource.dll" with a compromised version. When the SMS Executive service later loads this DLL under SYSTEM privileges, the attacker gains full code execution at the highest level. The attack does require network access to the SCCM environment, but no special SCCM permissions are needed for the initial foothold.

XM Cyber recommends restricting network access to the AdminService API and auditing SCCM role-based access control assignments, particularly accounts holding the Operations Administrator role or equivalent Create permissions. Teams should monitor the Site Server's "AdminService.log" for "System.IO.DirectoryNotFoundException" followed by an HTTP 500 response, a pattern indicating the path traversal was triggered. Unexpected modifications to adsource.dll in the Configuration Manager installation directory can provide another detection signal. Microsoft is reportedly working on patches for the remaining flaws but didn't immediately respond to CSO's request for comment. Organizations that rely on SCCM for fleet-wide management now face a window of exposure until October's planned fix, with only monitoring and access restrictions standing between attackers and total infrastructure takeover. The vulnerability highlights how trust assumptions embedded in certificate validation can become single points of failure, and why defensive architecture must assume that any credential—no matter how cheaply obtained—might eventually be weaponized against systems designed to manage thousands of endpoints.