Microsoft Configuration Manager SQL injection CVE-2024-43468 used in attacks; fixes available
Attackers are exploiting an old Microsoft Configuration Manager flaw to run commands without logging in. It affects business device-management servers. Ask IT to verify the revised KB29166583 security update is installed across affected sites.
Nothing to install on a personal device: this flaw is in an organisation's management servers. If your business or family office uses Configuration Manager, ask IT to verify the revised KB29166583 update is installed on affected releases, including existing secondary sites that require a manual update.
What’s happening
CVE-2024-43468 is a critical SQL injection flaw in Microsoft Configuration Manager, the business software also known as ConfigMgr or SCCM that manages fleets of computers. An attacker who can reach a vulnerable server can run commands on the server or its database without logging in. Microsoft lists releases 2303, 2309 and 2403 and provides KB29166583 for each. The original hotfix was withdrawn in September 2024 and replaced with a revised release; Microsoft formally disclosed the vulnerability on 8 October 2024. CISA confirmed exploitation by adding it to its catalogue on 12 February 2026. Microsoft's advisory still marks exploitation as “No”, contradicting CISA's listing. As of 3 November, the reviewed sources identify no attackers or victim totals; ransomware use remains unknown. Fixes are available for all three listed releases.
- What
- Flaw
- Affects
- Microsoft Configuration Manager (ConfigMgr/SCCM)
- Affected
- Microsoft Configuration Manager 2303 without the revised KB29166583 security update
Microsoft Configuration Manager 2309 without the revised KB29166583 security update
Microsoft Configuration Manager 2403 without the revised KB29166583 security update - Fixed in
- Microsoft Configuration Manager 2303 with revised KB29166583 (Microsoft-listed fixed build: 5.00.9106)
Microsoft Configuration Manager 2309 with revised KB29166583 (Microsoft-listed fixed build: 5.00.9122)
Microsoft Configuration Manager 2403 with revised KB29166583 (Microsoft-listed fixed build: 5.00.9128) - Since
- 12 Feb 2026
- Closed
- 12 Feb 2026
Timeline
- CISA added
CISA added CVE-2024-43468 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 5 March remediation deadline for US Federal Civilian Executive Branch agencies.
- Made public
Microsoft disclosed CVE-2024-43468 as a critical remote-code-execution vulnerability rated 9.8. It instructed affected Configuration Manager customers to install the security update through the management console.
- New fixFixed
Microsoft republished a revised KB29166583 to address the installation problem. Its instructions require customers who installed the original update to install the revision.
- Fix incompleteNo fix yet
Microsoft withdrew KB29166583 after discovering a problem following installation.
- New fixFixed
Microsoft released KB29166583, the management-point security update subsequently identified as the fix for CVE-2024-43468.
Sources
- Microsoft Configuration Manager Remote Code Execution Vulnerability — advisory dataMicrosoft · 8 Oct 2024
- CVE-2024-43468 affected products and security updatesMicrosoft · 8 Oct 2024
- Management point security update for Configuration Manager 2303Microsoft · 18 Sept 2024
- Management point security update for Configuration Manager 2309Microsoft · 7 Nov 2024
- Management point security update for Configuration Manager 2403Microsoft · 18 Sept 2024
- CISA flags critical Microsoft SCCM flaw as exploited in attacksBleepingComputer · 13 Feb 2026
- Attackers finally get around to exploiting critical Microsoft bug from 2024The Register · 13 Feb 2026