Cpe:2.3:a:microsoft:configuration_manager_2503:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amicrosoftconfiguration_manager_2503/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 15 Oct 2026 10:58:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrivilege Escalation in Microsoft Configuration Manager AdminService APIhttps://feed.craftedsignal.io/briefs/2026-10-cve-2025-59501/Thu, 15 Oct 2026 10:58:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2025-59501/CVE-2025-59501 is a privilege escalation vulnerability in the Microsoft Configuration Manager (SCCM) AdminService API that allows authenticated, low-privileged users to achieve full administrative control when Entra ID integration is enabled.CVE-2025-59501 is a privilege escalation vulnerability affecting Microsoft Configuration Manager (SCCM) environments where Entra ID (formerly Azure AD) integration is enabled. The vulnerability exists within the AdminService API, which can be manipulated by a low-privileged user to grant themselves Full Administrator permissions. Successful exploitation allows an attacker to seize control over the entire SCCM hierarchy, which typically governs managed endpoints, software distribution, and configuration policies across an enterprise. Microsoft has released patches addressing this issue across multiple versions, including 2403, 2409, and 2503. Given the public availability of a proof-of-concept (PoC) exploit, organizations utilizing affected versions of SCCM are at increased risk of internal privilege escalation and subsequent domain or infrastructure compromise via the management server.

Impact

Successful exploitation of CVE-2025-59501 results in the elevation of a standard user account to the Full Administrator role within the SCCM hierarchy. As the SCCM server often operates with high privileges within the Active Directory domain, this impact allows attackers to distribute malicious packages, execute arbitrary commands on managed clients, and compromise the management of the underlying infrastructure.

Recommendation

  • Upgrade all instances of Microsoft Configuration Manager to the fixed versions immediately: 5.00.9128.1037 for version 2403, 5.00.9132.1031 for version 2409, and 5.0.9135.1013 for version 2503.
  • Audit logs for the AdminService API to identify unauthorized calls to user management endpoints that add users to the Full Administrator role.
  • Restrict access to the AdminService API to known administrative endpoints or IP ranges if business operations permit.
]]>lowadvisoryprivilege-escalationsccmvulnerability