high8.0
CVE-2026-70049
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevat…
Impact
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Microsoft Configuration Manager 2603 | from 1.0.0 before 5.00.9146.1027 |
| Microsoft | Microsoft Configuration Manager | from 1.0.0 before 5.00.9135.1042 |
| Microsoft | Microsoft Configuration Manager 2509 | from 1.0.0 before 5.00.9141.1041 |