CVE-2024-43468
Microsoft Configuration Manager SQL Injection Vulnerability
Description
CVE-2024-43468 is a critical remote code execution vulnerability in Microsoft Configuration Manager caused by a SQL injection flaw. With a CVSS v3.1 base score of 9.8, this vulnerability allows an unauthenticated remote attacker to execute arbitrary commands on the Configuration Manager server by sending specially crafted requests that exploit the SQL injection weakness. The attack requires no authentication, no user interaction, and has low complexity, making it extremely easy to exploit from the network. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 5, 2026, and the ransomware association is currently classified as unknown. The EPSS score of 84.62% at the 99th percentile places this among the most actively exploited vulnerabilities tracked, indicating near-certain exploitation in exposed environments. Microsoft Configuration Manager is widely deployed across enterprise environments for endpoint management, software deployment, and compliance monitoring, making this vulnerability a severe threat to organizations of all sizes.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | configuration manager 2403 | - |
| microsoft | configuration manager 2409 | - |
| microsoft | configuration manager 2503 | - |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43468(US Government Resource)
Weakness Type
CWE-89: SQL Injection
CVE-2024-43468 is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). This weakness occurs when software incorporates user-controlled input into SQL queries without proper sanitization, allowing an attacker to inject malicious SQL statements that alter the query's intended logic. In Microsoft Configuration Manager, the vulnerable component accepts external input and constructs SQL queries that interact with the underlying database without adequately escaping or parameterizing the user-supplied values. An attacker can exploit this by injecting SQL syntax that breaks out of the intended query context and executes attacker-controlled SQL commands, which in the case of Configuration Manager can be escalated to operating system command execution through SQL Server features such as xp_cmdshell or other stored procedures. SQL injection remains one of the most prevalent and well-understood vulnerability classes, and its presence in a pre-authentication context in enterprise management software represents a fundamental security failure.
Impact Analysis
The impact of CVE-2024-43468 is devastating across all dimensions of the CIA triad, as reflected in its 9.8 CVSS score. Confidentiality is completely compromised because the SQL injection enables the attacker to extract the entire contents of the Configuration Manager database, which contains a wealth of sensitive organizational data including hardware and software inventories for all managed endpoints, network configurations, deployed software packages, user account information, collection memberships, compliance status reports, and potentially stored credentials used for software deployment and task sequences.
Integrity suffers maximum impact as the attacker can modify any data in the Configuration Manager database and, through remote code execution, alter server configurations and deployed content. This is particularly dangerous because Configuration Manager is used to deploy software and configurations to thousands of managed endpoints. An attacker who compromises the Configuration Manager server could inject malicious code into software packages, modify task sequences to deploy backdoors, or alter compliance policies to weaken security controls across the entire managed fleet.
Availability faces critical risk because the attacker can disrupt the Configuration Manager infrastructure, corrupt databases, encrypt server data, or use the server as a pivot point for broader network attacks. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms the worst-case scenario for accessibility: network-reachable, low complexity, no privileges needed, and no user interaction required. Configuration Manager servers that are accessible from broader network segments, rather than isolated management networks, face immediate and severe risk.
Exploit Maturity
CVE-2024-43468 exhibits extremely high exploit maturity, with an EPSS score of 84.62% at the 99th percentile, which is among the highest exploitation probability scores observed for any tracked vulnerability. This score, combined with CISA's KEV listing and a remediation deadline of March 5, 2026, confirms widespread and sustained exploitation activity. The Microsoft Security Response Center advisory (CVE-2024-43468) provides the official vendor documentation of the vulnerability.
SQL injection vulnerabilities in pre-authentication contexts are among the most reliably exploitable flaw types, requiring only basic HTTP request manipulation that can be automated with simple scripts. The 84.62% EPSS score indicates that the vast majority of exposed Configuration Manager instances are being targeted, and the exploitation tooling is mature, widely available, and integrated into automated attack frameworks. The pre-authentication nature eliminates the need for credential theft or social engineering, reducing the attack to a single HTTP request against the target server. While the ransomware association is currently unknown, the level of system access achieved through exploitation is fully sufficient to deploy ransomware across all endpoints managed by the compromised Configuration Manager server.
Remediation
-
Apply the Microsoft security update immediately for all affected Configuration Manager versions. Microsoft Configuration Manager versions 2403, 2409, and 2503 have received patches. Consult the Microsoft Security Response Center advisory for specific KB articles and update procedures for each affected version. Given the 84.62% EPSS score, any delay in patching represents near-certain compromise for exposed systems.
-
Restrict network access to the Configuration Manager server as an immediate compensating control. Ensure the server is only accessible from trusted management networks and not reachable from general user segments, guest networks, or the internet. Implement firewall rules and network segmentation to limit inbound connections to the specific ports used by Configuration Manager from authorized administrator workstations only.
-
Audit SQL Server configurations on the Configuration Manager database server. Disable
xp_cmdshelland other dangerous stored procedures if they are not required for legitimate operations. Review SQL Server service account permissions and ensure the account runs with minimum necessary privileges. These measures limit the impact of SQL injection even if the vulnerability is exploited before patching. -
Conduct a forensic investigation of the Configuration Manager server and database. Review IIS logs for suspicious requests, check SQL Server audit logs for unexpected query patterns, examine Windows event logs for unauthorized process execution, and verify that software packages, task sequences, and compliance baselines have not been tampered with. Any unauthorized modifications could indicate that the attacker has already compromised the management infrastructure.
-
Rotate all credentials and secrets stored within or accessible through Configuration Manager after patching. This includes network access accounts, client push installation accounts, task sequence service accounts, SQL Server credentials, and any credentials embedded in packages or scripts. Treat all stored credentials as potentially compromised.
-
Verify managed endpoint integrity by checking that software deployments, configuration baselines, and compliance policies match expected values. An attacker who compromised Configuration Manager could have pushed malicious content to managed devices during the exposure window.
Technical Details
CVE-2024-43468 is a SQL injection vulnerability in Microsoft Configuration Manager that enables remote code execution, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in the request handling logic of the Configuration Manager site server, where user-supplied input from HTTP requests is incorporated into SQL queries without proper parameterization or input validation.
The SQL injection pathway allows an unauthenticated attacker to manipulate database queries executed against the Configuration Manager site database, which runs on Microsoft SQL Server. Once the attacker can inject arbitrary SQL statements, the exploitation can be escalated from database-level access to operating system command execution through several well-known SQL Server features. The most common escalation path involves enabling and invoking xp_cmdshell, a built-in SQL Server extended stored procedure that executes operating system commands. Alternative escalation methods include OLE Automation procedures, CLR assembly execution, or writing files to disk through bulk insert operations.
Microsoft Configuration Manager versions 2403, 2409, and 2503 are confirmed affected. The Configuration Manager architecture places the site server as a central management point that communicates with distribution points, management points, and client agents across the enterprise. The site database contains comprehensive information about every managed device, deployed software, and configuration policy, making it an extraordinarily high-value target for attackers seeking to move laterally or deploy payloads across an organization.
The fix addresses the root cause by implementing proper input validation and parameterized queries in the affected request handlers, preventing attacker-controlled input from being interpreted as SQL syntax. Organizations should apply the update across all Configuration Manager site servers in their hierarchy, including central administration sites, primary sites, and secondary sites, as the vulnerability may be present in the shared codebase.
Frequently Asked Questions
What is CVE-2024-43468?
CVE-2024-43468 is a critical SQL injection vulnerability in Microsoft Configuration Manager that allows unauthenticated remote attackers to execute arbitrary commands on the server. It has a CVSS score of 9.8 and an EPSS score of 84.62%, indicating extremely high exploitation activity.
Why is CVE-2024-43468 so dangerous?
The vulnerability requires no authentication, no user interaction, and has low attack complexity. Microsoft Configuration Manager manages software deployment and configuration across thousands of endpoints, so compromising it gives an attacker the ability to push malicious software to every managed device in the organization.
Which versions of Microsoft Configuration Manager are affected?
Microsoft Configuration Manager versions 2403, 2409, and 2503 are confirmed affected. All organizations running these versions should apply the security update immediately.
Can CVE-2024-43468 be exploited without credentials?
Yes. This is a pre-authentication vulnerability. An attacker only needs network access to the Configuration Manager server to exploit the SQL injection flaw and achieve remote code execution.
What should I do if my Configuration Manager server was exposed?
Apply the security update immediately, then conduct a thorough forensic investigation. Review database integrity, verify software packages and task sequences have not been tampered with, check for unauthorized accounts, and rotate all credentials stored in or accessible through Configuration Manager.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.