Potential for Remote Code Execution in Microsoft SCCM via Newly-Discovered Exploit Chain

What it is

A four-stage SCCM exploit chain (XM Cyber) taking any unprivileged domain user to SYSTEM-level RCE on the primary site server. One link — the AdminService RBAC bypass, CVE-2026-47301 — was patched July 14, 2026; the remaining three stay exploitable via the built-in Operations Administrator role until ConfigMgr 2609 (planned October 2026). The chain was reported to Microsoft May 23, 2026.

How it works

Four flaws, each feeding the next:

1. RBAC bypass (CVE-2026-47301). In ConsoleExtensionMetadataController.cs, UploadExtension calls this.CheckAccess(Guid.Empty, 1024); the sibling UploadExtensionInChunks omits that check entirely, so any authenticated AD user can POST a .cab. The post-patch path: any account with the Operations Administrator role — or a custom role holding Create (bitmask 1024) on SMS_ConsoleExtensionData — reaches the identical downstream chain through the normal UploadExtension endpoint.
2. Weak signature check. VerifyExtensionCabSignature calls VerifyEmbeddedSignature with checkCRL set to false (revoked certs ignored) and enforces no signer identity. Any ~$58 commercial cert — or an expired/revoked one — is accepted as trusted.
3. "CabSlip" path traversal. CabinetUtils.GetFileName strips root specifiers but not .. sequences; ExtractOpenFileHandler passes raw names to Path.Combine. A .cab built with makecab.exe and a .ddf directive file containing traversal sequences yields arbitrary file write anywhere on the server.
4. DLL hijack. SMS Executive (running as NT AUTHORITY\SYSTEM) runs adsysdis.dll every few minutes with signature verification — but adsysdis.dll dynamically loads adsource.dll from ...\bin\x64 with no integrity check. Overwriting adsource.dll via CabSlip gives SYSTEM code execution on next load.

flowchart TD
  A[Unpriv domain user] -->|UploadExtensionInChunks, no CheckAccess| C[Upload .cab]
  B[Ops Admin / Create 1024] -->|UploadExtension, patch-proof| C
  C -->|checkCRL=false, any cert| D[Signature accepted]
  D -->|CabSlip .ddf traversal| E[Overwrite adsource.dll]
  E -->|SMS Executive loads via adsysdis.dll| F[RCE as SYSTEM]

What to do

• Apply the July 2026 fix for CVE-2026-47301 (closes only the unauthenticated endpoint).
• Restrict network access to the AdminService API port by firewall. Disabling the underlying SCCMProviderGraph.exe is not supported by Microsoft.
• Audit RBAC: strictly limit the Operations Administrator role and any custom role with Create on SMS_ConsoleExtensionData — these still trigger the full chain post-patch.
• Detect: monitor <InstallationDir>\Logs\AdminService.log for System.IO.DirectoryNotFoundException (cleanup of the ExpandedCab temp folder fails when files are redirected out) followed immediately by HTTP 500, and watch for unexpected modification of adsource.dll in the install directory.

Caveats

The July patch is partial — three of four links remain live through the Operations Administrator path until the ConfigMgr 2609 release, which is planned, not shipped.