CVE-2025-47179
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Microsoft Configuration Manager contains improper access control allowing an authorized attacker to elevate privileges locally. The vulnerability requires valid credentials but no user interaction.
Risk Assessment
An attacker with a valid account could elevate privileges to administrative level on the targeted system. This may lead to full compromise of the workstation or server.
Recommendation
Apply Microsoft security updates for Configuration Manager. Limit accounts with local logon rights and enforce least privilege.
Other vulnerabilities in Microsoft Configuration Manager
See all- CVE-2026-88075High
SQL injection vulnerability in Microsoft Configuration Manager due to improper neutralization of special elements in SQL commands. An authorized attacker can elevate privileges over a network.
- CVE-2026-70049High
An SQL injection vulnerability exists in Microsoft Configuration Manager. An authorized attacker can exploit this flaw to elevate privileges over an adjacent network.
- CVE-2026-47301High
An improper access control vulnerability in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. The flaw can be exploited remotely by an authenticated user.
- CVE-2025-59501Medium
Authentication bypass by spoofing exists in Microsoft Configuration Manager, allowing an authorized attacker to perform spoofing over an adjacent network. The vulnerability enables an attacker to impersonate a trusted entity.
- CVE-2025-55320Medium
Improper neutralization of special elements used in an SQL command (SQL injection) in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
Original NVD description (English source)
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS