CVE-2024-43468 Microsoft Configuration Manager SQL Injection
An attacker can execute arbitrary code on Microsoft Configuration Manager servers via SQL injection, requiring immediate patching.
- Exploited in the wild
- Since 12 Feb 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-43468?
CVE-2024-43468 is a critical SQL injection vulnerability in Microsoft Configuration Manager, published on 8 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Microsoft Configuration Manager Remote Code Execution Vulnerability
Weakness: CWE-89
Which versions are affected by CVE-2024-43468?
It affects 3 products.
Products include Microsoft Configuration Manager 2403, Microsoft Configuration Manager 2409, Microsoft Configuration Manager 2503.
How do I fix CVE-2024-43468?
No fix has been published for CVE-2024-43468 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 5 Mar 2026.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-43468 being exploited?
Yes. Attackers have exploited CVE-2024-43468 in the wild since at least 12 Feb 2026.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Configuration Manager
Sources
Also known as GHSA-m786-h9gp-8q53.