CVE-2024-43468: Microsoft Configuration Manager SQL injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required, confirmed exploitation via CISA KEV, and a very high EPSS score make this an urgent patch.

What it is

CVE-2024-43468 is a SQL injection flaw (CWE-89) in Microsoft Configuration Manager that leads to remote code execution. It carries a CVSS 3.1 score of 9.8 (critical) with a network vector and no privileges or user interaction required. Because Configuration Manager is a central management plane for large Windows estates, compromise can have wide downstream reach.

Impact

An unauthenticated network attacker can execute arbitrary code on the affected Configuration Manager instance. Given the role of the product, that access can be leveraged to reach managed endpoints and the broader environment.

Attack surface

Reachable over the network per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so no authentication and no user interaction are needed. The record does not specify which interface or endpoint is targeted.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2026-02-12 with a remediation due date of 2026-03-05, indicating exploitation in the wild. EPSS gives a 30-day probability of 0.82022 (99.6th percentile); no ransomware campaign use is documented.

What to do

• Apply the Microsoft vendor update for Configuration Manager as the first action; consult the MSRC advisory for the fixed builds.
• If patching cannot be completed by the CISA due date, follow the vendor mitigations or discontinue use of the product per BOD 22-01 guidance.
• Restrict network access to Configuration Manager servers and their management interfaces to trusted administrative networks only.
• Review and harden the SQL/database layer and service accounts used by Configuration Manager to limit blast radius.
• Treat any internet-exposed Configuration Manager instance as urgent and remove that exposure.

Detection

• Hunt web and service logs on Configuration Manager servers for anomalous SQL syntax or injection-like payloads in request parameters.
• Monitor for unexpected child processes or command execution spawned by Configuration Manager or its database services.
• Alert on unusual outbound connections or new administrative activity originating from Configuration Manager servers.
• Correlate with CISA KEV status and verify patch level of all Configuration Manager instances in inventory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.