CVE-2024-43468

9.8

CRITICAL CVSS 3.1

Microsoft Configuration Manager SQL Injection Vulnerability - [Actively Exploited]

Description

Microsoft Configuration Manager Remote Code Execution Vulnerability

INFO

Published Date :

Oct. 8, 2024, 6:15 p.m.

Last Modified :

Feb. 13, 2026, 2:04 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Mar 05, 2026 | 15 days left

Alert Date: Feb 12, 2026 | 5 days ago

Description :

Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43468

Affected Products

The following products are affected by CVE-2024-43468 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	configuration_manager
2	Microsoft	configuration_manager_2503
3	Microsoft	configuration_manager_2409
4	Microsoft	configuration_manager_2403

: Total Affected Vendor : 1 | Products : 4

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]

Solution

This information is provided by the 3rd party feeds.

Apply the security patch according to KB29166583.

Public PoC/Exploit Available at Github

CVE-2024-43468 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-43468.

URL	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43468	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43468	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-43468 is associated with the following CWEs:

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-43468 weaknesses.

CAPEC-7: Blind SQL Injection Blind SQL Injection CAPEC-66: SQL Injection SQL Injection CAPEC-108: Command Line Execution through SQL Injection Command Line Execution through SQL Injection CAPEC-109: Object Relational Mapping Injection Object Relational Mapping Injection CAPEC-110: SQL Injection through SOAP Parameter Tampering SQL Injection through SOAP Parameter Tampering CAPEC-470: Expanding Control over the Operating System from the Database Expanding Control over the Operating System from the Database

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

alimostafaeiorg/Activedirectory-Deployment---SCCM

None

Updated: 9 months, 3 weeks ago

0 stars 0 fork 0 watcher

Born at : April 21, 2025, 7:51 a.m. This repo has been linked 1 different CVEs too.

nikallass/CVE-2024-43468_mTLS_go

CVE-2024-43468 SCCM SQL Injection Exploit (mTLS unextractable client cert from MacOS keychain version)

Python Go

Updated: 10 months, 4 weeks ago

2 stars 0 fork 0 watcher

Born at : Jan. 17, 2025, 12:20 p.m. This repo has been linked 1 different CVEs too.

synacktiv/CVE-2024-43468

None

Python

Updated: 7 months, 4 weeks ago

89 stars 11 fork 11 watcher

Born at : Nov. 26, 2024, 12:39 p.m. This repo has been linked 1 different CVEs too.

tadash10/Detailed-Analysis-and-Mitigation-Strategies-for-CVE-2024-38124-and-CVE-2024-43468

None

Python

Updated: 1 year, 3 months ago

0 stars 0 fork 0 watcher

Born at : Oct. 25, 2024, 2:53 p.m. This repo has been linked 2 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-43468 vulnerability anywhere in the article.

CybersecurityNews

CISA Warns of Microsoft Configuration Manager SQL Injection Vulnerability Exploited in Attacks

CISA Warns Microsoft Configuration Manager SQL Injection Vulnerability CISA has issued an urgent alert about a critical SQL injection vulnerability in Microsoft Configuration Manager (SCCM). Tracked a ...

Published Date: Feb 14, 2026 (3 days, 10 hours ago)

The Register

Attackers finally get around to exploiting critical Microsoft bug from 2024

Ignore patches at your own risk. According to Uncle Sam, a SQL injection flaw in Microsoft Configuration Manager patched in October 2024 is now being actively exploited, exposing unpatched businesses ...

Published Date: Feb 13, 2026 (3 days, 19 hours ago)

security.nl

VS meldt misbruik van kritiek lek in Microsoft Configuration Manager

Een kritieke kwetsbaarheid in Microsoft Configuration Manager waarvoor eind 2024 een beveiligingsupdate verscheen is misbruikt bij aanvallen, zo stelt het Amerikaanse cyberagentschap CISA. Microsoft C ...

Published Date: Feb 13, 2026 (4 days ago)

TheCyberThrone

CISA KEV Catalog Update Feb 12 2026

February 13, 2026On February 12, 2026, CISA added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. The addition confirms active exploitation in the wild and triggers a re ...

Published Date: Feb 13, 2026 (4 days, 1 hour ago)

The Hacker News

Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability

Threat actors have started to exploit a recently disclosed critical security flaw impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products, according to watchTowr. "Overni ...

Published Date: Feb 13, 2026 (4 days, 5 hours ago)

Daily CyberSecurity

Snipe-IT Flaw Chained: XSS (CVE-2025-59712) to RCE (CVE-2025-59713) Achieves Full Server Compromise, PoC Released

Image: Synacktiv Cybersecurity researchers at Synacktiv have uncovered two critical vulnerabilities in Snipe-IT, an open-source IT asset management system, that can be chained together to achieve remo ...

Published Date: Oct 07, 2025 (4 months, 1 week ago)

Daily CyberSecurity

ScriptCase Flaws (CVE-2025-47227/47228): Pre-Auth RCE & Admin Takeover Risk for Web Servers, PoC Published

In a recent security advisory, researchers from Synacktiv revealed two chained vulnerabilities in ScriptCase’s Production Environment module—known as the “prod console”—that can lead to pre-authentica ...

Published Date: Jul 07, 2025 (7 months, 1 week ago)

The Cyber Express

Microsoft Patches 117 CVEs: Focus on Critical and Zero-Day Threats

Microsoft has released the October 2024 Patch Tuesday, addressing a total of 117 Common Vulnerabilities and Exposures (CVEs). This month’s Microsoft Patch Tuesday update includes three vulnerabilities ...