CISA Flags Actively Exploited Microsoft Configuration Manager RCE (CVE-2024-43468)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-43468 to its Known Exploited Vulnerabilities (KEV) catalog after determining the flaw is being actively exploited in the wild. The vulnerability is a critical (CVSS 9.8) SQL injection in Microsoft Configuration Manager (ConfigMgr/SCCM) that can allow an unauthenticated remote attacker to achieve remote code execution by sending specially crafted requests, enabling command execution on the ConfigMgr server and/or its underlying site database with high/SYSTEM-level impact. CISA set a remediation deadline of March 5 for U.S. Federal Civilian Executive Branch agencies under its Binding Operational Directive requirements; public reporting noted Microsoft’s advisory had previously assessed exploitation as “less likely,” and Microsoft had not (as of reporting) publicly detailed the threat actors or scope of exploitation.

The issue was originally patched by Microsoft in October 2024 after being reported by Synacktiv, and proof-of-concept exploit code was later published (including by Synacktiv), lowering the barrier to weaponization. Separate CISA KEV updates the same week also drove patching urgency across other widely deployed products (including SolarWinds Web Help Desk and multiple Apple platforms for a reportedly “extremely sophisticated” targeted attack), reinforcing that organizations should treat KEV additions as a high-confidence signal to accelerate patching and exposure reduction—particularly for internet-reachable management tooling like ConfigMgr that can provide broad administrative control if compromised.