Public Exploit Code Released for Microsoft SCCM Remote Code Execution Vulnerability

Public proof-of-concept exploit code is now available for CVE-2026-47301, a critical remote code execution vulnerability affecting Microsoft Configuration Manager (SCCM).

The disclosed exploit chain could allow a low-privileged domain user to gain SYSTEM-level execution on a Configuration Manager Primary Site Server, creating a potentially serious enterprise takeover risk.

Security researcher Omri Baso published a proof-of-concept repository that includes source code, project files, a crafted CAB archive, and a compiled release. The researcher described the issue as a multi-stage exploit chain rather than a single flaw.

According to the disclosure, CVE-2026-47301 combines broken access control, path traversal during CAB extraction, arbitrary file write capabilities, certificate-verification bypass, and DLL hijacking.

Together, these weaknesses can enable an attacker to place attacker-controlled files into the Configuration Manager installation directory and cause a privileged SCCM service to load them.

Public Exploit Released for Microsoft SCCM Flaw

The attack targets the SMS_EXECUTIVE service, a core SCCM component that runs with elevated privileges. The published research states that a malicious CAB file can be used to write DLL files outside their intended extraction directory through traversal sequences.

The files are ultimately placed in the Configuration Manager binX64 directory, where the service can load them. The exploit uses a DLL proxying approach involving adsource.dll and adsource_original.dll.

The malicious DLL is designed to execute the attacker’s code while forwarding expected functionality to the original library, reducing the likelihood of crashing the SCCM service.

The researcher observed that the relevant DLL load may occur on a recurring schedule, meaning exploitation may not produce immediate visible results.

A successful attack reportedly requires identifying the SCCM Primary Site Server. Although this information may not be directly published in Active Directory, the researcher said it can be inferred by reviewing permissions on the System Management container.

Domain computer accounts granted Full Control or GenericAll permissions over that container may indicate Configuration Manager site servers.

The release of functional exploit material significantly increases the risk to organizations that have not applied Microsoft’s security updates.

SCCM servers are especially attractive targets because they manage software deployment, endpoint configuration, and administrative operations across enterprise Windows environments.

SYSTEM-level code execution on a Primary Site Server could provide attackers with a powerful platform for lateral movement, malware deployment, credential theft, or ransomware activity.

The published demonstration CAB enables and modifies the built-in RID 500 Administrator account as part of its proof-of-concept behavior.

Defenders should treat the presence of unexpected changes to this account, suspicious DLLs in the Configuration Manager installation directory, or unusual activity involving CAB uploads as high-priority indicators for investigation.

Organizations using Microsoft Configuration Manager should immediately review Microsoft’s advisory for CVE-2026-47301, identify exposed or unpatched Primary Site Servers, and apply the relevant security update.

Administrators should also restrict access to SCCM management interfaces, audit permissions in Active Directory’s System Management container, and monitor the SMS_EXECUTIVE service for abnormal DLL-loading events. The public availability of exploit code changes this from a patch-management issue into an urgent detection-and-response concern.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.