CVE-2026-70049

SQL injection vulnerability in Microsoft Configuration Manager due to improper neutralization of special elements in SQL commands. An authorized attacker can elevate privileges over a network.

An improper access control vulnerability in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. The flaw can be exploited remotely by an authenticated user.

Microsoft Configuration Manager contains improper access control allowing an authorized attacker to elevate privileges locally. The vulnerability requires valid credentials but no user interaction.

Authentication bypass by spoofing exists in Microsoft Configuration Manager, allowing an authorized attacker to perform spoofing over an adjacent network. The vulnerability enables an attacker to impersonate a trusted entity.

Improper neutralization of special elements used in an SQL command (SQL injection) in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.