AI analysis
CVE-2026-88075 is a SQL injection flaw (CWE-89) in Microsoft Configuration Manager. An attacker who is already authenticated with low privileges can send a crafted request over the network that is not properly neutralized before it is used in a SQL command. Successful exploitation elevates privileges and can fully compromise confidentiality, integrity, and availability of the affected site (CVSS 3.1 base score 8.8). Organizations running Configuration Manager are affected; specific version ranges are not listed in the provided data. It is not on CISA's KEV list, and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 security updates for Configuration Manager as soon as they are available for your site. Until then, restrict network access to the site and management roles to trusted administrators and review low-privilege accounts that can reach Configuration Manager over the network.
Affected
| Microsoft Configuration Manager | — |
Estimated exposure
largeOn the order of tens of thousands of enterprise deployments — Configuration Manager is a standard Microsoft enterprise endpoint-management product used by a large share of organizations; exact install counts are not in the CVE data, and most site servers sit on internal networks rather than the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.