The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-43468 (CVSS 9.8) to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild exploitation targeting Microsoft Configuration Manager (MECM). Discovered by Synacktiv, the flaw is an unauthenticated SQL injection vulnerability within the MP_Location management point service exposed via /ccm_system/request in LocationMgr.dll. When processing client XML requests during getMachineID operations, the service constructs database queries without input sanitization. Because the SMS executive service connects to Microsoft SQL Server with sysadmin privileges, unauthenticated remote attackers can execute arbitrary SQL commands.

Attackers weaponize the injection via xp_cmdshell or CLR assemblies to achieve remote code execution as NT AUTHORITY\SYSTEM on the site database server. Full control over the site server permits hierarchy takeover, database credential theft, and forced deployment of malicious packages to all managed endpoints across Active Directory. Microsoft released in-console updates for Configuration Manager versions 2403 and 2309, with CISA ordering federal remediation.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unauthenticated network ingress combined with default sysadmin database permissions converts a web-tier injection flaw into immediate SYSTEM-level host compromise, bypassing endpoint defenses and collapsing enterprise administrative boundaries.
• Bullet 2 — Strategic & Defender Imperative: Defenders must urgently apply Microsoft in-console hotfixes across all Configuration Manager sites, restrict management point ingress to trusted subnets, and audit SQL database logs for anomalous xp_cmdshell invocations and rogue administrative tasks.