CISA Issues Urgent Warning on Microsoft Configuration Manager SQL Injection Vulnerability Under Active Exploitation

The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SQL injection vulnerability in Microsoft Configuration Manager to its Known Exploited Vulnerabilities (KEV) catalogue. This vulnerability poses an immediate risk to organizations using the enterprise management platform.

SQL Injection Enables Command Execution

The vulnerability, identified as CVE-2024-43468, allows unauthenticated remote attackers to execute arbitrary commands on affected servers and databases by sending specially crafted requests. The issue arises from unsafe processing of user-supplied input, classified under CWE-89 for improper neutralization of SQL commands.

Microsoft Configuration Manager, used globally to manage large-scale IT infrastructure, becomes a high-value target when compromised, potentially providing attackers with extensive network access and control over managed endpoints. The vulnerability’s exploitation does not require authentication, significantly lowering the barrier for threat actors to compromise vulnerable systems.

Once exploited, attackers can manipulate database contents, extract sensitive data, modify system settings, or pivot deeper into enterprise networks. The flaw's severity is heightened by Configuration Manager's privileged position within corporate environments, where it typically maintains credentials and access to numerous devices.

CISA's February 12, 2026 advisory mandates federal agencies apply vendor-provided mitigations by March 5, 2026, in accordance with Binding Operational Directive 22-01 requirements. Organizations using cloud-based deployments must follow applicable BOD 22-01 guidance for cloud services, while those unable to implement mitigations should discontinue product use until patches are available.

Although CISA has not confirmed whether the vulnerability is being used in ransomware campaigns, its characteristics make it attractive for initial access operations commonly preceding ransomware deployment.

Microsoft has released security updates addressing CVE-2024-43468. Organizations should prioritize patching Configuration Manager installations immediately. Security teams should review logs for suspicious SQL queries, unusual database activity, or unauthorized command execution attempts. Network segmentation and restricting Configuration Manager access to trusted networks can reduce exposure while patches are deployed.

The active exploitation status highlights the urgency of remediation, as threat actors frequently target enterprise management platforms to establish persistent footholds and move laterally across networks.

Based on reporting by GBHackers.