high8.8
CVE-2026-88075
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevat…
Impact
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Microsoft Configuration Manager 2509 | from 1.0.0 before 5.00.9141.1039 |
| Microsoft | Microsoft Configuration Manager 2603 | from 1.0.0 before 5.00.9146.1026 |
| Microsoft | Microsoft Configuration Manager | from 1.0.0 before 5.00.9135.1040 |
| Microsoft | Configuration Manager 2503 | All versions |
| Microsoft | Configuration Manager 2509 | All versions |
| Microsoft | Configuration Manager 2603 | All versions |