--- title: It took $58 to break Microsoft’s SCCM, but a patch made... description: Security researchers at XM Cyber disclosed an exploit chain against Microsoft's System Center Configuration Manager (SCCM) that lets a low-privileged domain... canonical: https://daily.dev/posts/it-took-58-to-break-microsoft-s-sccm-but-a-patch-made-it-harder-k9ub4slqq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: It took $58 to break Microsoft’s SCCM, but a patch made it harder | daily.dev og:description: Security researchers at XM Cyber disclosed an exploit chain against Microsoft's System Center Configuration Manager (SCCM) that lets a low-privileged domain... og:url: https://daily.dev/posts/it-took-58-to-break-microsoft-s-sccm-but-a-patch-made-it-harder-k9ub4slqq og:image: https://api.daily.dev/og/posts/k9ub4Slqq.png og:image:alt: It took $58 to break Microsoft’s SCCM, but a patch made it harder og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # It took $58 to break Microsoft’s SCCM, but a patch made it harder **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary Security researchers at XM Cyber disclosed an exploit chain against Microsoft's System Center Configuration Manager (SCCM) that lets a low-privileged domain user escalate to SYSTEM-level code execution on the primary site server. The chain combines a broken authorization check in the AdminService chunked-upload endpoint, a path-traversal flaw called CabSlip, weak code-signing validation (bypassed with a $58 commercial certificate), and an unsigned DLL-loading path in the SMS Executive service. Microsoft patched the initial authorization flaw (CVE-2026-47301) in July, but researchers say the remaining links are still exploitable via the Operations Administrator role or equivalent Create permissions, and a full fix isn't expected until ConfigMgr 2609 in October. Defenders are advised to restrict AdminService network access, audit RBAC assignments, and monitor logs for signs of the path-traversal being triggered. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the CabSlip vulnerability in Microsoft SCCM? CabSlip is a path-traversal flaw in Microsoft SCCM that lets a malicious CAB archive escape its intended temporary extraction directory and write files elsewhere on the filesystem. Attackers use this arbitrary file-write to overwrite adsource.dll, a secondary library loaded by the SYSTEM-level SMS Executive service without its own signature check, enabling code execution as SYSTEM. _Teams patching SCCM environments can track emerging exploit chains and advisories on daily.dev._ ### Does Microsoft's July 2026 patch for CVE-2026-47301 fully fix the SCCM exploit chain found by XM Cyber? No, the July patch only fixes the initial authorization flaw in SCCM's AdminService chunked-upload endpoint, blocking standard domain users from that entry point. The remaining chain, including CabSlip and the weak code-signing check, is still reachable through the Operations Administrator role or custom roles with Create permission on SMS_ConsoleExtensionData, and full fixes aren't expected until ConfigMgr 2609 in October. _Security teams tracking partial fixes versus full remediation timelines can follow SCCM patch status on daily.dev._ ### How much does it cost to get a code-signing certificate that bypasses SCCM's DLL signature check? About $58, the price of a Certum Open Source Developer Certificate used by XM Cyber researchers in their proof of concept. SCCM's signature validation only checks that a signature is structurally valid and non-expired, without confirming it belongs to Microsoft or the target organization, and revocation checks are disabled, so leaked or cheap commercial certificates can cross the trust boundary. _Developers evaluating code-signing trust gaps in enterprise tools can follow such research on daily.dev._ ## Similar posts on daily.dev - [Critical Microsoft bug from 2024 under exploitation](https://daily.dev/posts/critical-microsoft-bug-from-2024-under-exploitation-b3av1sodp) · The Register · 0 upvotes · 0 comments - [Researcher creates workaround for Microsoft Defender security patch](https://daily.dev/posts/researcher-creates-workaround-for-microsoft-defender-security-patch-30gt7sysk) · CSO Online · 0 upvotes · 0 comments - [Disgruntled researcher leaks “BlueHammer” Windows zero-day exploit](https://daily.dev/posts/disgruntled-researcher-leaks-bluehammer-windows-zero-day-exploit-cmxqgiyie) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft) [View this post on daily.dev](https://daily.dev/posts/it-took-58-to-break-microsoft-s-sccm-but-a-patch-made-it-harder-k9ub4slqq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"It took $58 to break Microsoft’s SCCM, but a patch made it harder","url":"https://daily.dev/posts/it-took-58-to-break-microsoft-s-sccm-but-a-patch-made-it-harder-k9ub4slqq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/it-took-58-to-break-microsoft-s-sccm-but-a-patch-made-it-harder-k9ub4slqq"},"datePublished":"2026-08-13T12:16:47.185Z","dateModified":"2026-09-14T06:29:36.716Z","description":"Security researchers at XM Cyber disclosed an exploit chain against Microsoft's System Center Configuration Manager (SCCM) that lets a low-privileged domain...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ad85556bfb3ee01fc67f7dec9a700f56?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ad85556bfb3ee01fc67f7dec9a700f56?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/it-took-58-to-break-microsoft-s-sccm-but-a-patch-made-it-harder-k9ub4slqq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"It took $58 to break Microsoft’s SCCM, but a patch made it harder"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/it-took-58-to-break-microsoft-s-sccm-but-a-patch-made-it-harder-k9ub4slqq#faq","mainEntity":[{"@type":"Question","name":"What is the CabSlip vulnerability in Microsoft SCCM?","acceptedAnswer":{"@type":"Answer","text":"CabSlip is a path-traversal flaw in Microsoft SCCM that lets a malicious CAB archive escape its intended temporary extraction directory and write files elsewhere on the filesystem. Attackers use this arbitrary file-write to overwrite adsource.dll, a secondary library loaded by the SYSTEM-level SMS Executive service without its own signature check, enabling code execution as SYSTEM. Teams patching SCCM environments can track emerging exploit chains and advisories on daily.dev."}},{"@type":"Question","name":"Does Microsoft's July 2026 patch for CVE-2026-47301 fully fix the SCCM exploit chain found by XM Cyber?","acceptedAnswer":{"@type":"Answer","text":"No, the July patch only fixes the initial authorization flaw in SCCM's AdminService chunked-upload endpoint, blocking standard domain users from that entry point. The remaining chain, including CabSlip and the weak code-signing check, is still reachable through the Operations Administrator role or custom roles with Create permission on SMS_ConsoleExtensionData, and full fixes aren't expected until ConfigMgr 2609 in October. Security teams tracking partial fixes versus full remediation timelines can follow SCCM patch status on daily.dev."}},{"@type":"Question","name":"How much does it cost to get a code-signing certificate that bypasses SCCM's DLL signature check?","acceptedAnswer":{"@type":"Answer","text":"About $58, the price of a Certum Open Source Developer Certificate used by XM Cyber researchers in their proof of concept. SCCM's signature validation only checks that a signature is structurally valid and non-expired, without confirming it belongs to Microsoft or the target organization, and revocation checks are disabled, so leaked or cheap commercial certificates can cross the trust boundary. Developers evaluating code-signing trust gaps in enterprise tools can follow such research on daily.dev."}}]} ```