CVE-2024-43468

What it actually does

This is a remotely exploitable Microsoft Configuration Manager flaw that can allow an unauthenticated network attacker to execute code on an affected Configuration Manager site system. The CVSS vector indicates exploitation requires network access only, low complexity, no prior authentication, and no user interaction, with potential full compromise of confidentiality, integrity, and availability. Because Configuration Manager commonly has privileged access to endpoints, software deployment workflows, credentials, certificates, and management infrastructure, successful exploitation can become a high-impact enterprise foothold rather than a compromise of a single application server. The provided metadata also lists downstream Chainguard Linux kernel-related packages with fixed versions, but the core vulnerability intelligence is for Microsoft Configuration Manager; organizations should validate affected product applicability against authoritative vendor advisories and their installed components.

Why it matters to the business

Compromise of Configuration Manager can disrupt endpoint management, software deployment, patching, imaging, inventory, and compliance operations. An attacker who gains control of this platform may be able to push malicious software broadly, tamper with deployment packages, access sensitive operational data, or use the server as a launch point into managed systems. The vulnerability is listed in CISA KEV, has active in-the-wild exploitation, a high EPSS score of 0.6111, and a CISA remediation due date of 2026-03-05, so unpatched internet-reachable or broadly reachable Configuration Manager infrastructure should be treated as a priority exposure even though the supplied metadata does not indicate ransomware use.

How an attack unfolds

An attacker first identifies an exposed or reachable Microsoft Configuration Manager site system, typically a management point, SMS provider, or related web-facing Configuration Manager component. Because the vulnerability is network-exploitable without credentials or user interaction, the attacker can send crafted requests to the vulnerable service. If the vulnerable code path is reachable, the malformed request triggers the underlying flaw and results in attacker-controlled code execution in the context of the affected Configuration Manager service or application pool. From there, the attacker may run commands, stage tooling, access Configuration Manager databases or content libraries, modify deployment artifacts, harvest credentials or tokens available to the service, and pivot to clients or infrastructure that trust Configuration Manager. Given active exploitation and KEV inclusion, defenders should assume exploitation attempts may be opportunistic and automated as well as targeted against organizations with exposed management infrastructure.

How to fix it

Apply the Microsoft security update or hotfix that remediates CVE-2024-43468 for all affected Microsoft Configuration Manager site servers and roles, including primary sites, secondary sites, management points, SMS providers, and any internet-facing or DMZ-hosted roles. Prioritize systems reachable from untrusted networks. Where supplied downstream package metadata is applicable, update Chainguard packages to the listed fixed versions: linux-aws-generic 6.18.3-r0 or later, linux-qemu-generic 6.18.3-r0 or later, linux-azure-generic 6.18.3-r0 or later, linux-gcp-generic 6.18.3-r0 or later, linux-qemu-rc 6.19_rc4-r0 or later, and linux-vmware-generic 6.18.3-r0 or later; entries marked fixed in 0 should be verified against the package vendor’s advisory because they may represent non-applicable, virtual, or metadata-only packages. If immediate patching is not possible, restrict access to Configuration Manager roles to trusted administrative networks, remove internet exposure where feasible, enforce firewall allowlisting, disable unnecessary roles, monitor IIS and Configuration Manager logs closely, and ensure service accounts have least privilege. After patching, rotate credentials, review deployment packages and task sequences, and validate that no unauthorized changes were made if exploitation is suspected.

How to confirm the fix worked

Confirm the installed Microsoft Configuration Manager build, hotfix rollup, and site version against Microsoft’s advisory for the vulnerability. Validate every site server and role, not only the central administration or primary site. From a network perspective, verify that Configuration Manager web endpoints are not reachable from the public internet unless explicitly required and protected. Review asset inventory, vulnerability scanner results, and Configuration Manager console update status to ensure the remediation is present. For downstream Chainguard package contexts, query installed package versions and confirm they meet or exceed the listed fixed versions, especially 6.18.3-r0 for stable cloud-specific kernels and 6.19_rc4-r0 for the qemu release-candidate package. Finally, perform post-remediation log review for pre-patch exploitation attempts because applying the update does not remove persistence, malicious packages, altered task sequences, or credentials already exposed before patching.

Typical attack path

1. Scan for Microsoft Configuration Manager site systems, management points, SMS provider endpoints, or related IIS-exposed Configuration Manager services.
2. Fingerprint the exposed service version or infer vulnerability from reachable Configuration Manager endpoints.
3. Send a crafted unauthenticated network request that reaches the vulnerable Configuration Manager code path.
4. Achieve code execution under the affected service, IIS application pool, or Configuration Manager component context.
5. Execute discovery commands to enumerate domain, local privileges, Configuration Manager roles, database connectivity, packages, applications, and managed client collections.
6. Establish persistence through dropped files, scheduled tasks, service changes, web-accessible payloads, or altered Configuration Manager deployment content.
7. Use Configuration Manager trust relationships to move laterally, deploy malicious packages, collect credentials, or impact endpoint operations.

How to detect it

Look for evidence of exploitation on Configuration Manager site servers, management points, SMS providers, IIS hosts, and related database systems. Prioritize the period before patching and any period where services were reachable from untrusted networks. Review IIS access logs for unusual unauthenticated requests to Configuration Manager virtual directories, abnormal HTTP methods, high-error bursts, encoded payloads, long query strings, suspicious user agents, or requests followed by server-side process creation. Review Configuration Manager logs for unexpected administrative actions, package/application/task-sequence creation, management point errors, provider activity outside normal administrative windows, and content library changes. Review Windows Security, PowerShell, Sysmon, IIS, SQL Server, and EDR telemetry for child processes spawned by w3wp.exe, SMS_EXECUTIVE, SMS_SITE_COMPONENT_MANAGER, SMSPROV, or related Configuration Manager services. Search for new files in web directories, Configuration Manager inboxes, temp directories, content libraries, and startup locations. Investigate use of command interpreters, script engines, download utilities, credential-dumping tools, scheduled task creation, new services, and unexpected outbound connections from site servers. If SQL injection is suspected from the exploitation pattern, review SQL Server logs and traces for anomalous queries, xp_cmdshell enablement, unusual database logins, failed query bursts, and Configuration Manager database access outside expected application behavior. Because the provided threat actor field appears to describe a vulnerability rather than a named actor, do not rely on actor-specific tradecraft; use behavior-based hunting around remote code execution and Configuration Manager abuse.

• C:\Program Files\Microsoft Configuration Manager\Logs\mpcontrol.log
• C:\Program Files\Microsoft Configuration Manager\Logs\SMSProv.log
• C:\Program Files\Microsoft Configuration Manager\Logs\sitecomp.log
• C:\Program Files\Microsoft Configuration Manager\Logs\hman.log
• C:\Program Files\Microsoft Configuration Manager\Logs\distmgr.log
• C:\Program Files\Microsoft Configuration Manager\Logs\pkgxfermgr.log
• C:\Program Files\Microsoft Configuration Manager\Logs\SMS_EXECUTIVE.log
• C:\inetpub\logs\LogFiles\W3SVC
• /SMS_MP/
• /CCM_System/
• /CCM_System_WindowsAuth/
• /ccm_system/request
• /ccm_system_windowsauth/request
• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> cscript.exe
• w3wp.exe -> wscript.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> curl.exe
• w3wp.exe -> wget.exe
• SMS_EXECUTIVE.exe -> cmd.exe
• SMS_EXECUTIVE.exe -> powershell.exe
• SMS_SITE_COMPONENT_MANAGER.exe -> cmd.exe
• SMS_SITE_COMPONENT_MANAGER.exe -> powershell.exe
• SMSPROV.exe -> cmd.exe
• SMSPROV.exe -> powershell.exe
• xp_cmdshell
• sp_configure 'xp_cmdshell'
• powershell -enc
• powershell -EncodedCommand
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user
• schtasks /create
• sc create
• C:\Windows\Temp\*.aspx
• C:\inetpub\wwwroot\*.aspx
• C:\Program Files\Microsoft Configuration Manager\inboxes\
• C:\Program Files\Microsoft Configuration Manager\EasySetupPayload\
• C:\Program Files\Microsoft Configuration Manager\CMUStaging\

What your security team should do

• Treat this as urgent due to active in-the-wild exploitation, KEV status, CVSS 9.8, and high EPSS likelihood; patch exposed Configuration Manager infrastructure first.
• Inventory all Microsoft Configuration Manager site systems, management points, SMS providers, distribution points, and internet-facing roles, then verify their patch status individually.
• Remove direct internet exposure for Configuration Manager services where possible; otherwise restrict access using VPN, private connectivity, firewall allowlists, and reverse-proxy controls.
• Hunt for anomalous IIS requests, unexpected child processes spawned by IIS or Configuration Manager services, unauthorized package or task sequence modifications, and new persistence mechanisms on site servers.
• Review Configuration Manager administrative activity, package creation, application deployment, collection membership changes, and content library changes around the suspected exposure window.
• Rotate or reissue credentials, certificates, service account secrets, and deployment-related secrets if compromise cannot be ruled out.
• Increase monitoring on managed clients for suspicious deployments or scripts originating from Configuration Manager after the exposure window.
• Validate any supplied downstream package findings against authoritative vendor advisories to avoid confusing Microsoft Configuration Manager remediation with unrelated Linux package metadata.