Dashboard / CVE-2026-70049

CVE-2026-70049

HIGH
MEDIUM Priority: 0.21 BB Relevance: 42/100
Published: 2026-10-13 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Adjacent
AC: High
PR: Low
UI: None
S: Changed
C: High
I: High
A: High

Description

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Microsoft Microsoft Configuration Manager 1.0.0 < 5.00.9135.1042

References & Advisories (1)

Bug Bounty Relevance

42 / 100
✓ No user interaction

CVSS Score

8.0 / 10.0 v3.1
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

EPSS — Exploitation Probability

2.66%
Raw Score 0.026570
Percentile 85.6%
Date 2026-10-29

EPSS Trend

2026-10-29
0.02657
2026-10-28
0.02657

Intelligence Sources

mitre ref →

External Links