{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amicrosoftconfiguration_manager_2403/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:configuration_manager:2403:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:configuration_manager:2409:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:configuration_manager:2503:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:configuration_manager_2403:*:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:configuration_manager_2409:*:*:*:*:*:*:*:*","cpe:2.3:a:microsoft:configuration_manager_2503:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":4.8,"id":"CVE-2025-59501"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Configuration Manager 2403 (\u003c 5.00.9128.1037)","Configuration Manager 2409 (\u003c 5.00.9132.1031)","Configuration Manager 2503 (\u003c 5.0.9135.1013)"],"_cs_severities":["low"],"_cs_tags":["privilege-escalation","sccm","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eCVE-2025-59501 is a privilege escalation vulnerability affecting Microsoft Configuration Manager (SCCM) environments where Entra ID (formerly Azure AD) integration is enabled. The vulnerability exists within the AdminService API, which can be manipulated by a low-privileged user to grant themselves Full Administrator permissions. Successful exploitation allows an attacker to seize control over the entire SCCM hierarchy, which typically governs managed endpoints, software distribution, and configuration policies across an enterprise. Microsoft has released patches addressing this issue across multiple versions, including 2403, 2409, and 2503. Given the public availability of a proof-of-concept (PoC) exploit, organizations utilizing affected versions of SCCM are at increased risk of internal privilege escalation and subsequent domain or infrastructure compromise via the management server.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2025-59501 results in the elevation of a standard user account to the Full Administrator role within the SCCM hierarchy. As the SCCM server often operates with high privileges within the Active Directory domain, this impact allows attackers to distribute malicious packages, execute arbitrary commands on managed clients, and compromise the management of the underlying infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Microsoft Configuration Manager to the fixed versions immediately: 5.00.9128.1037 for version 2403, 5.00.9132.1031 for version 2409, and 5.0.9135.1013 for version 2503.\u003c/li\u003e\n\u003cli\u003eAudit logs for the AdminService API to identify unauthorized calls to user management endpoints that add users to the Full Administrator role.\u003c/li\u003e\n\u003cli\u003eRestrict access to the AdminService API to known administrative endpoints or IP ranges if business operations permit.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T10:58:55Z","date_published":"2026-10-15T10:58:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-59501/","summary":"CVE-2025-59501 is a privilege escalation vulnerability in the Microsoft Configuration Manager (SCCM) AdminService API that allows authenticated, low-privileged users to achieve full administrative control when Entra ID integration is enabled.","title":"Privilege Escalation in Microsoft Configuration Manager AdminService API","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-59501/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:microsoft:configuration_manager_2403:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}