CISA Raises Alarm on Exploited Microsoft SCCM Vulnerability

Microsoft Configuration Manager Vulnerability Exploited by Cyber Attackers

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive for U.S. government agencies to protect their systems against a critical vulnerability in Microsoft Configuration Manager. This vulnerability, known as CVE-2024-43468, was patched by Microsoft in October 2024 but is now being actively exploited in attacks.

Microsoft Configuration Manager, also referred to as ConfigMgr or SCCM, is an essential IT administration tool used for managing large groups of Windows servers and workstations.

The vulnerability, initially reported by Synacktiv, is a SQL injection flaw that allows remote attackers to execute arbitrary commands with the highest level of privileges on the server and database of the Microsoft Configuration Manager site.

Microsoft described the exploitation method as sending specially crafted requests to the target environment, enabling attackers to execute commands on the server and database. Although Microsoft initially deemed the likelihood of exploitation as low, proof-of-concept code was shared by Synacktiv in November 2024.

Despite Microsoft not updating its advisory, CISA has identified the vulnerability as actively exploited and has mandated Federal Civilian Executive Branch agencies to patch their systems by March 5th under Binding Operational Directive 22-01.

The cybersecurity agency emphasized the importance of mitigating such vulnerabilities promptly, as they are common targets for cybercriminals and pose significant risks to federal enterprises. CISA recommended all network defenders, including those in the private sector, to secure their systems against CVE-2024-43468 attacks.

Modern IT infrastructure outpaces manual workflows. Learn how to reduce delays, enhance reliability with automated responses, and create intelligent workflows using existing tools in the new Tines guide.

See also  Chaos in Cybersecurity: Microsoft Defender Portal Outage Disrupts Threat Hunting Operations

Get the guide