SCCM Attack Chain Exposes Cost of Weak Trust

An attacker with nothing more than an ordinary domain account and a $58 certificate can now walk through Microsoft's System Center Configuration Manager (SCCM) like it's an open door. Researchers at XM Cyber discovered a chain of four weaknesses that leads to full code execution as "NT AUTHORITY\SYSTEM" on the primary site server, and while Microsoft has patched one link, the rest of the chain remains intact for a specific set of privileged users.

A Chain of Four Flaws

The attack chain combines a broken authorization check in SCCM's AdminService upload functionality, a path-traversal vulnerability XM Cyber calls "CabSlip," weak code-signing validation that any attacker can satisfy with a $58 commercial certificate, and an unsigned DLL-loading path in the SMS Executive service. Together, these let a standard domain user—someone with no SCCM-specific privileges—move from low-level access to the highest levels of the management infrastructure.

Enterprises rely on SCCM to deploy operating systems, manage patches, distribute software, and monitor compliance across large Windows fleets. The stakes are especially high because the system holds keys to the entire managed environment.

"After the Site Server is compromised, all of its managed clients are compromised as well, which usually means taking over all the company assets," XM Cyber's Omri Baso told CSO.

The Initial Foothold

The attack begins with SCCM's AdminService API. The API's normal extension-upload endpoint checks whether a user has the required permission, but its "chunked-upload" counterpart does not. That oversight allows any authenticated Active Directory user to submit a malicious CAB archive without SCCM administrative privileges.

Microsoft addressed this specific hole in July with a patch tracked as CVE-2026-47301. The fix blocks that particular route for standard domain users. However, XM Cyber found that the downstream chain remains reachable through another path: users assigned the built-in Operations Administrator role, or a custom role with Create permission on "SMS_ConsoleExtensionData," can still trigger the same sequence.

There is an important qualification here. XM Cyber said it believes organizations are unlikely to be exposed through the Operations Administrator route because it is already a highly privileged role.

CabSlip and the Path Traversal

Once the CAB file reaches the server, the second flaw—CabSlip—allows files to escape the intended temporary extraction directory and be written elsewhere on the filesystem. This arbitrary file-write capability is the key to the attack, because it lets the attacker replace adsource.dll, a secondary library loaded by the SYSTEM-level SMS Executive service without its own signature check.

When the service subsequently loads the DLL, the attacker gets code execution as SYSTEM.

A $58 Certificate Crosses the Trust Boundary

The chain is notable because SCCM's signature validation does not establish that the signing certificate belongs to Microsoft or the target organization. It checks only that the signature is structurally valid and non-expired, while revocation checks are disabled.

That means an attacker does not need an enterprise certificate. XM Cyber said the attack depends on a code-signing certificate and can also abuse certificates leaked online. For his own research, Baso used a Certum Open Source Developer Certificate that cost about $58.

Detection and Mitigation

For defenders, XM Cyber recommends restricting network access to the AdminService API and auditing SCCM RBAC assignments, particularly accounts with the Operations Administrator role or equivalent Create permissions.

Teams should also monitor the Site Server's AdminService.log for a "System.IO.DirectoryNotFoundException" followed by an HTTP 500 response, a pattern that can indicate the path traversal was triggered, XM Cyber added.

Unexpected modifications to adsource.dll in the Configuration Manager installation directory can provide another detection signal.

Patch Status and What's Next

Microsoft fixed the initial authorization flaw, tracked as CVE-2026-47301, in July, but Baso said the remaining links in the chain are not expected to be fully addressed until ConfigMgr 2609, planned for October.

Microsoft is reportedly working on patches for the remaining flaws. It did not immediately respond to CSO's request for comment.

Why This Matters for Your Infrastructure

This attack chain underscores how a single weak link—here, a validation check that accepts any structurally sound certificate—can undermine an entire management platform. The fact that an attacker can achieve SYSTEM access on the site server, and from there potentially take over every managed client, means the blast radius is enormous.

For security teams, this suggests a few critical priorities. First, limit access to the AdminService API and monitor it closely for signs of the specific log patterns XM Cyber highlighted. Second, review RBAC assignments to ensure no accounts hold more privilege than they need, especially the Operations Administrator role. And third, treat the certificate validation gap as a reminder that signature checks are only as strong as the trust that backs them.

Until ConfigMgr 2609 arrives with the full fix, these are the measures that stand between a $58 certificate and full compromise of your Windows estate.