CISA Warns of Actively Exploited SQL Injection Flaw in Microsoft Configuration Manager

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SQL injection vulnerability in Microsoft Configuration Manager to its Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation by threat actors in the wild.

This unauthenticated flaw poses immediate risks to organizations relying on the enterprise management platform for large-scale IT infrastructure oversight.

Tracked as CVE-2024-43468, the vulnerability enables remote attackers to execute arbitrary commands on affected servers and underlying databases through specially crafted requests, stemming from improper neutralization of user-supplied input classified under CWE-89.

Microsoft Configuration Manager, widely deployed across enterprises, serves as a high-value target due to its privileged access to credentials and thousands of endpoints.

Exploitation requires no authentication, allowing attackers to manipulate database contents, extract sensitive configuration data, alter system settings, or pivot laterally for deeper network compromise.

The flaw’s severity escalates in environments where Configuration Manager maintains extensive control, potentially granting threat actors persistent footholds ideal for ransomware initial access or supply chain attacks.

CISA’s February 12, 2026, advisory mandates federal agencies to apply mitigations by March 5, 2026, per Binding Operational Directive 22-01. Cloud-based deployments must follow BOD 22-01 cloud guidance, with unpatched systems requiring discontinuation until remedies are available.

While not yet linked to confirmed ransomware, the vulnerability’s characteristics align with tactics used in initial access operations by opportunistic actors.

Microsoft has released security updates addressing the issue, urging immediate patching of vulnerable installations.

Security teams should scrutinize logs for suspicious SQL queries, anomalous database activity, or unauthorized command execution.

Implementing network segmentation and restricting access to trusted sources further mitigates exposure during remediation.

Active exploitation underscores the need for swift action, as enterprise management tools remain prime targets for lateral movement.

Organizations should prioritize vulnerability scanning and endpoint monitoring to detect ongoing threats.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google