Microsoft Configuration Manager 2403 vulnerabilities

5 CVEs affecting Microsoft Configuration Manager 2403, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47179, published 2025-11-11.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-43468: Microsoft Configuration Manager SQL Injection Vulnerability, published 2024-10-08. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-02-12. EPSS: 81% chance of exploitation in the next 30 days. Microsoft Configuration Manager Remote Code Execution Vulnerability
• CVE-2025-59501, published 2025-10-31. Medium severity, CVSS 4.8. EPSS: 3.3% chance of exploitation in the next 30 days. Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network.
• CVE-2025-55320, published 2025-10-14. Medium severity, CVSS 6.8. EPSS: 0.7% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
• CVE-2025-47179, published 2025-11-11. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally.
• CVE-2025-59213, published 2025-10-14. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges over an adjacent network.