Researchers at XM Cyber have shown that a standard domain user can chain multiple flaws in Microsoft System Center Configuration Manager to reach code execution as SYSTEM on the primary site server. The attack, which requires network access to the SCCM environment, uses a $58 commercial code-signing certificate to cross a trust boundary.
Four flaws work together in the chain. The AdminService chunked-upload endpoint skips an authorization check, a path traversal bug called CabSlip lets files land outside their intended directory, code-signing validation can be fooled, and the SMS Executive service loads an unsigned DLL. Microsoft fixed the initial authorization flaw, CVE-2026-47301, in July, but XM Cyber said the remaining links persist for users with the built-in Operations Administrator role or custom roles with Create permission on SMS_ConsoleExtensionData. Full remediation is not expected until ConfigMgr 2609, planned for October.
Signature validation in SCCM checks that a certificate is structurally valid and non-expired but does not confirm it belongs to Microsoft or the organization, and revocation checks are disabled. The researcher used a Certum Open Source Developer Certificate costing about $58.
Once the CAB reaches the server, CabSlip lets files escape the extraction directory, and the attacker can replace adsource.dll, which the SYSTEM-level SMS Executive service loads without its own signature check. Compromising the site server compromises all managed clients, typically meaning all company assets, the researchers warn.
