Microsoft Configuration Manager SQL Injection Vulnerability

Public source report. This item is not matched to your stack and does not establish whether you are affected.

• NewsExploited · CISA KEVMicrosoft · Configuration Manager

  Microsoft Configuration Manager SQL Injection Vulnerability

  CVE-2024-43468

  Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.

  CISA's required action · due 5 Mar 2026 for U.S. federal civilian agencies

  Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  Cited by CISA: msrc.microsoft.com · nvd.nist.gov

  Added to KEV 12 Feb 2026 · Source checked 4 Nov 2026, 16:40 UTC · CISA KEV entry

  Loading voting…