CVE-2024-43468: Microsoft Configuration Manager SQL injection

CVE-2024-43468 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-02-12

Microsoft Configuration Manager, a tool used by IT departments to manage and secure large fleets of computers, contains a critical security flaw. An attacker can exploit this vulnerability over the network without needing any login credentials to take control of the server or its database. This could lead to a total compromise of the IT management infrastructure, allowing unauthorized software deployment or data theft across the organization.

Technologies: Microsoft Configuration Manager. Vendors: Microsoft.

Quick answers

Is CVE-2024-43468 exploited in the wild?
Yes. CVE-2024-43468 is known to be exploited in the wild, first recorded on 12 February 2026. Treat it as urgent.
How severe is CVE-2024-43468?
Critical severity, with a CVSS score of 9.8, published 12 February 2026.
Which products and versions are affected?
Microsoft Configuration Manager 2303, 2309, 2403, 2409, 2503.
Is there a fix for CVE-2024-43468?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-43468 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-43468?
Check whether you run Microsoft Configuration Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability (CWE-89) exists in Microsoft Configuration Manager due to improper neutralization of special elements in SQL commands. An unauthenticated attacker can exploit this by sending specially crafted network requests to the target environment. Because these requests are processed in an unsafe manner, the attacker can execute arbitrary commands on the server or the underlying database. This vulnerability has been observed being exploited in the wild, and Microsoft has released updates to address the issue across several versions including 2303 through 2503.

Affected products

  • Microsoft Configuration Manager 2303, 2309, 2403, 2409, 2503

Timeline

  • 2024-10-08: disclosed: Initial disclosure by Microsoft
  • 2026-02-12: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2026-02-12: exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.