$58 Certificate, Four Flaws: Researchers Show How SCCM Can Hand Attackers the Keys to an Entire Company

Key points

• Researchers at XM Cyber found that a normal company account, with no special IT privileges, can be used to take over Microsoft SCCM servers and every device they manage.
• The attack chains four separate weaknesses, one of which Microsoft patched in July 2025 (CVE-2026-47301), with the remaining three not expected to be fully fixed until October 2025.
• A commercial code-signing certificate costing roughly $58 was enough to pass SCCM's signature check, because the software doesn't verify that the certificate belongs to Microsoft or the target organisation.
• Organisations can reduce exposure now by restricting network access to the SCCM AdminService API and auditing which accounts hold the Operations Administrator role.
• No confirmed real-world exploitation has been reported, but full technical details are now public.

What is SCCM, and why does it matter here?

Microsoft SCCM, formally called System Center Configuration Manager, is the tool large IT teams use to deploy operating systems, push patches and manage thousands of company computers from a single console. Whoever controls it controls every device it manages.

Researchers at XM Cyber found they could start with an ordinary staff account and work up to running any code they chose on the SCCM server as "NT AUTHORITY\SYSTEM," the highest level of Windows control. Omri Baso of XM Cyber told CSO Online plainly: once the server is taken over, every computer it manages is taken over too. The attack does require network access to the SCCM environment, which limits opportunistic exploitation but won't stop an insider or a threat actor who's already inside the perimeter.

How did the attack actually work?

The chain has four links, each building on the last.

SCCM's AdminService API (a programming interface for remote administration) has an upload function that comes in two forms: a standard upload that checks permissions, and a split-file, or "chunked," upload that doesn't. Any authenticated company account could use the second route to send a malicious CAB archive, a compressed file package, to the server.

Once that package arrived, a path-traversal flaw the researchers nicknamed "CabSlip" let the files escape their designated landing folder and be written anywhere on the server's drive. The attacker could use this to replace a file called "adsource.dll," a library the SCCM service loads automatically at the highest privilege level.

Here's where the certificate comes in. SCCM checks that uploaded files carry a valid digital signature, the electronic equivalent of a wax seal. But it doesn't check whether that seal belongs to Microsoft or to the target organisation. It only confirms the seal is structurally correct and not expired, and revocation checks are disabled entirely. Baso used a Certum Open Source Developer Certificate, available commercially for about $58, to satisfy that check.

With the replacement library in place and the signature check passed, the SCCM service loaded the malicious file the next time it ran, handing over full system-level control.

What has Microsoft fixed, and what is still outstanding?

Microsoft's July patch closes the initial door for standard domain accounts. Accounts holding the built-in Operations Administrator role can still reach the downstream parts of the chain, though XM Cyber says that role is already highly privileged, so organisations with sensible access controls face lower risk by that route.

This story sits alongside our 11 August report on a Windows kernel flaw already being exploited in the wild, a useful reminder of how quickly unpatched Windows-adjacent gaps attract real attackers.

What should IT teams do right now?

Three concrete steps are available before October's full patch arrives. Restrict network access to the AdminService API so only authorised management systems can reach it. Review which accounts carry the Operations Administrator role or any custom role with "Create" permission on "SMS_ConsoleExtensionData," and remove any that shouldn't. Watch the server's "AdminService.log" for the error message "System.IO.DirectoryNotFoundException" paired with an HTTP 500 response, a pattern XM Cyber says can flag a path-traversal attempt. Unexpected changes to "adsource.dll" inside the Configuration Manager installation folder are a second warning sign worth monitoring.

Microsoft hadn't responded to requests for comment at the time of publication.

Common questions

Does this affect ordinary employees directly?

Not directly. The attack targets IT infrastructure, not individual desktops. Employees don't need to take any action.

Could my organisation's computers be taken over without anyone noticing?

Yes, in theory. If an attacker already inside your network used this chain successfully, every computer managed by your SCCM server could fall under their control. The detection signals above are the practical first line of defence while patches are pending.

Do I need to do anything as an employee?

Not directly. This is a fix IT and security teams need to apply. If you receive unusual software prompts or are asked to re-enter your company password unexpectedly, report it to your IT desk.