A proof-of-concept (PoC) exploit has been publicly released for CVE-2026-47301, a critical remote code execution vulnerability in Microsoft Configuration Manager (SCCM). This exploit enables attackers with low-level domain credentials to execute code with SYSTEM privileges on a Configuration Manager Primary Site Server, posing a significant risk to enterprise environments.
Security researcher Omri Baso has made the PoC available on GitHub, providing source code, project files, a specially crafted CAB archive, and a compiled release. The exploit leverages a combination of security flaws, including broken access control, path traversal during CAB extraction, arbitrary file write capabilities, certificate verification bypass, and DLL hijacking. These vulnerabilities collectively allow an attacker to place malicious files into the Configuration Manager installation directory, leading to their execution by privileged SCCM services.
Details of the Exploit
The attack specifically targets the SMS_EXECUTIVE service, a core component of SCCM that operates with elevated privileges. By using a malicious CAB file, attackers can exploit path traversal sequences to write DLL files outside their intended extraction directory, ultimately placing them in the Configuration Manager’s bin\X64 directory. The SMS_EXECUTIVE service then loads these DLLs, executing the attacker’s code. To maintain service stability and avoid detection, the exploit employs a DLL proxying technique involving ‘adsource.dll’ and ‘adsource_original.dll’, ensuring the malicious DLL forwards expected functionality to the original library.
Notably, the DLL loading process occurs on a recurring schedule, approximately every five minutes, which may delay the visible effects of the exploit. Successful exploitation requires identifying the SCCM Primary Site Server. While this information may not be directly available in Active Directory, it can be inferred by examining permissions on the System Management container. Domain computer accounts with Full Control or GenericAll permissions over this container may indicate Configuration Manager site servers.
Implications and Recommendations
The public release of this exploit significantly increases the risk to organizations that have not yet applied Microsoft’s security updates. SCCM servers are critical as they manage software deployment, endpoint configuration, and administrative operations across enterprise Windows environments. Gaining SYSTEM-level code execution on a Primary Site Server could provide attackers with a powerful platform for lateral movement, malware deployment, credential theft, or ransomware activities.
Organizations utilizing Microsoft Configuration Manager should promptly review Microsoft’s advisory for CVE-2026-47301, identify exposed or unpatched Primary Site Servers, and apply the relevant security updates. Additionally, administrators should restrict access to SCCM management interfaces, audit permissions in Active Directory’s System Management container, and monitor the SMS_EXECUTIVE service for abnormal DLL-loading events. The availability of this exploit code elevates the urgency from a routine patch-management task to a critical detection-and-response priority.
Given the exploit’s complexity and the combination of multiple vulnerabilities, it underscores the importance of comprehensive security practices, including regular patching, vigilant monitoring, and thorough auditing of system permissions and configurations. Organizations must remain proactive to mitigate such sophisticated threats effectively.
