{"id":"microsoft-configmgr-sql-injection-attacks-feb-2026","category":"patch","status":"closed","title":"Microsoft Configuration Manager SQL injection CVE-2024-43468 used in attacks; fixes available","tldr":"Attackers are exploiting an old Microsoft Configuration Manager flaw to run commands without logging in. It affects business device-management servers. Ask IT to verify the revised KB29166583 security update is installed across affected sites.","summary":"CVE-2024-43468 is a critical SQL injection flaw in Microsoft Configuration Manager, the business software also known as ConfigMgr or SCCM that manages fleets of computers. An attacker who can reach a vulnerable server can run commands on the server or its database without logging in. Microsoft lists releases 2303, 2309 and 2403 and provides KB29166583 for each. The original hotfix was withdrawn in September 2024 and replaced with a revised release; Microsoft formally disclosed the vulnerability on 8 October 2024. CISA confirmed exploitation by adding it to its catalogue on 12 February 2026. Microsoft's advisory still marks exploitation as “No”, contradicting CISA's listing. As of 3 November, the reviewed sources identify no attackers or victim totals; ransomware use remains unknown. Fixes are available for all three listed releases.","action":"Nothing to install on a personal device: this flaw is in an organisation's management servers. If your business or family office uses Configuration Manager, ask IT to verify the revised KB29166583 update is installed on affected releases, including existing secondary sites that require a manual update.","product":"Microsoft Configuration Manager (ConfigMgr/SCCM)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2024-43468"],"tags":["microsoft","configuration-manager","sql-injection","remote-code-execution","actively-exploited"],"affected":["Microsoft Configuration Manager 2303 without the revised KB29166583 security update","Microsoft Configuration Manager 2309 without the revised KB29166583 security update","Microsoft Configuration Manager 2403 without the revised KB29166583 security update"],"fixed":["Microsoft Configuration Manager 2303 with revised KB29166583 (Microsoft-listed fixed build: 5.00.9106)","Microsoft Configuration Manager 2309 with revised KB29166583 (Microsoft-listed fixed build: 5.00.9122)","Microsoft Configuration Manager 2403 with revised KB29166583 (Microsoft-listed fixed build: 5.00.9128)"],"matches":[],"sources":[{"kind":"advisory","title":"Microsoft Configuration Manager Remote Code Execution Vulnerability — advisory data","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2024-43468","by":"Microsoft","date":"2024-10-08"},{"kind":"advisory","title":"CVE-2024-43468 affected products and security updates","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/affectedProduct?%24filter=cveNumber%20eq%20%27CVE-2024-43468%27","by":"Microsoft","date":"2024-10-08"},{"kind":"advisory","title":"Management point security update for Configuration Manager 2303","url":"https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2303/29166583","by":"Microsoft","date":"2024-09-18"},{"kind":"advisory","title":"Management point security update for Configuration Manager 2309","url":"https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2309/29166583","by":"Microsoft","date":"2024-11-07"},{"kind":"advisory","title":"Management point security update for Configuration Manager 2403","url":"https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2403/29166583","by":"Microsoft","date":"2024-09-18"},{"kind":"news","title":"CISA flags critical Microsoft SCCM flaw as exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-flags-microsoft-configmgr-rce-flaw-as-exploited-in-attacks/amp/","by":"BleepingComputer","date":"2026-02-13"},{"kind":"news","title":"Attackers finally get around to exploiting critical Microsoft bug from 2024","url":"https://www.theregister.com/security/2026/02/13/critical-microsoft-bug-from-2024-under-exploitation/4853311","by":"The Register","date":"2026-02-13"}],"started":"2026-02-12","closed":"2026-02-12","created":"2026-11-03T22:29:39.885Z","updated":"2026-11-03T22:29:39.885Z","cve_notes":[{"cve":"CVE-2024-43468","name":"SQL injection in Microsoft Configuration Manager","what":"Unsafe handling of requests in Microsoft Configuration Manager lets an attacker who can reach the service run commands on its server or underlying database without logging in.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-02-12","added":"2026-11-03T22:23:50.754Z","kind":"cisa-added","text":"CISA added CVE-2024-43468 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 5 March remediation deadline for US Federal Civilian Executive Branch agencies.","url":"https://www.bleepingcomputer.com/news/security/cisa-flags-microsoft-configmgr-rce-flaw-as-exploited-in-attacks/amp/","by":"BleepingComputer","patch":null},{"at":"2024-10-08","added":"2026-11-03T22:23:50.754Z","kind":"disclosed","text":"Microsoft disclosed CVE-2024-43468 as a critical remote-code-execution vulnerability rated 9.8. It instructed affected Configuration Manager customers to install the security update through the management console.","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2024-43468","by":"Microsoft","patch":null},{"at":"2024-09-18","added":"2026-11-03T22:23:50.754Z","kind":"new-fix","text":"Microsoft republished a revised KB29166583 to address the installation problem. Its instructions require customers who installed the original update to install the revision.","url":"https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2403/29166583","by":"Microsoft","patch":"patched"},{"at":"2024-09-05","added":"2026-11-03T22:23:50.754Z","kind":"fix-incomplete","text":"Microsoft withdrew KB29166583 after discovering a problem following installation.","url":"https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2403/29166583","by":"Microsoft","patch":"none"},{"at":"2024-09-04","added":"2026-11-03T22:23:50.754Z","kind":"new-fix","text":"Microsoft released KB29166583, the management-point security update subsequently identified as the fix for CVE-2024-43468.","url":"https://learn.microsoft.com/en-us/intune/configmgr/hotfix/2403/29166583","by":"Microsoft","patch":"patched"}],"url":"https://hard.fyi/live/microsoft-configmgr-sql-injection-attacks-feb-2026/","json":"https://hard.fyi/api/live?id=microsoft-configmgr-sql-injection-attacks-feb-2026"}