SCCM Attack Chain Reaches SYSTEM Privileges
๐กA cheap certificate and four SCCM flaws could turn one domain account into control of an entire Windows fleet.
โก 30-Second TL;DR
What Changed
A standard domain user could upload a malicious CAB through the vulnerable SCCM AdminService chunked-upload endpoint.
Why It Matters
A compromised SCCM primary site server can expose every managed client, potentially turning one domain account into an enterprise-wide compromise. AI teams running Windows-based training, inference, or developer fleets should treat SCCM as a high-value control-plane asset.
What To Do Next
Audit SCCM AdminService permissions and SMS_ConsoleExtensionData roles now, block unnecessary Create rights, and apply the ConfigMgr 2609 update when released.
Key Points
- โขA standard domain user could upload a malicious CAB through the vulnerable SCCM AdminService chunked-upload endpoint.
- โขThe CabSlip path-traversal flaw enables arbitrary file writes outside the intended extraction directory.
- โขReplacing adsource.dll lets the SYSTEM-level SMS Executive service load attacker-controlled code.
- โขMicrosoft patched CVE-2026-47301, but broader remediation is expected in ConfigMgr 2609, planned for October.
- โขA commercial certificate costing about $58 could bypass SCCM's weak code-signing trust validation.
๐ง Deep Insight
AI-generated analysis for this event.
๐ Enhanced Key Takeaways
- โขThe vulnerability chain, dubbed 'PowerPipe' by XM Cyber researchers, specifically targets the SMS Executive service, which runs with SYSTEM privileges by default on all SCCM site servers.
- โขThe path-traversal vulnerability (CabSlip) exploits the way the AdminService handles chunked file uploads, allowing attackers to bypass directory restrictions by manipulating the file path metadata.
- โขMicrosoft's partial fix in July 2026 addressed the authorization check on the AdminService but did not fully remediate the underlying file handling logic that allows the DLL replacement.
- โขThe attack requires the attacker to have already compromised a standard domain user account, making this a post-exploitation privilege escalation technique rather than an initial access vector.
- โขThe weak code-signing validation identified allows the SMS Executive service to load unsigned or improperly signed DLLs if they are placed in specific directories, bypassing standard security checks.
๐ ๏ธ Technical Deep Dive
- The AdminService chunked-upload endpoint utilizes a custom implementation for handling large file transfers that fails to sanitize path inputs before writing to the disk.
- The SMS Executive service (smsexec.exe) periodically scans specific directories for plugins or components, providing the mechanism for the DLL hijacking once the malicious adsource.dll is placed.
- The vulnerability relies on the fact that the service account running the SMS Executive service has write access to the directory where it expects to load its dependencies.
- The certificate validation bypass leverages a flaw in the SCCM client/server communication protocol where the trust chain is not strictly enforced for certain administrative components.
๐ฎ Future ImplicationsAI analysis grounded in cited sources
โณ Timeline
Weekly AI Recap
Read this week's curated digest of top AI events โ
๐Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: Computerworld โ