Loading story…
A zero-day exploit chain affecting Microsoft Configuration Manager (SCCM) has been documented as CVE-2026-47301, allowing a domain user to escalate control through the SCCM SMS Provider. The attack involves planting a malicious adsource.dll—or similarly named adsource_*.dll library—in the SMS Provider bin\X64 directory, where it can be loaded by SCCM components in a privileged service context and yield SYSTEM-level code execution on hosts assigned the SMS Provider role.
Splunk released detections for the exploit indicators, including creation or modification of adsource.dll files in the SMS Provider directory and suspicious child processes spawned by the SCCM SMS Executive service, smsexec.exe. Security teams should treat shells, scripting engines, or post-exploitation tools launched by smsexec.exe as evidence of successful service exploitation and a full compromise of the affected host, while validating file-write alerts against authorized SCCM upgrades and hotfix activity.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk Enterprise Security provides the "Windows SCCM Smsexec Spawned a Suspicious Child Process" detection, which flags shells, scripting engines, and post-exploitation tools launched by smsexec.exe. A confirmed alert indicates successful SCCM SMS Executive service exploitation and a full compromise of the affected host.
Splunk Enterprise Security provides the "Windows SCCM Adsource DLL Was Planted In SMS Provider Directory" detection for creation or modification of adsource.dll or adsource_*.dll in the SCCM SMS Provider bin\X64 directory. The analytic is intended to detect DLL side-loading associated with CVE-2026-47301.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) added **CVE-2024-43468** to its Known Exploited Vulnerabilities (KEV) catalog after determining the flaw is being **actively exploited in the wild**. The vulnerability is a **critical (CVSS 9.8) SQL injection** in *Microsoft Configuration Manager* (ConfigMgr/SCCM) that can allow an **unauthenticated remote attacker** to achieve **remote code execution** by sending specially crafted requests, enabling command execution on the ConfigMgr server and/or its underlying site database with **high/`SYSTEM`-level impact**. CISA set a remediation deadline of **March 5** for U.S. Federal Civilian Executive Branch agencies under its Binding Operational Directive requirements; public reporting noted Microsoft’s advisory had previously assessed exploitation as “less likely,” and Microsoft had not (as of reporting) publicly detailed the threat actors or scope of exploitation. The issue was originally patched by Microsoft in **October 2024** after being reported by **Synacktiv**, and proof-of-concept exploit code was later published (including by Synacktiv), lowering the barrier to weaponization. Separate CISA KEV updates the same week also drove patching urgency across other widely deployed products (including **SolarWinds Web Help Desk** and multiple **Apple** platforms for a reportedly “extremely sophisticated” targeted attack), reinforcing that organizations should treat KEV additions as a high-confidence signal to accelerate patching and exposure reduction—particularly for internet-reachable management tooling like ConfigMgr that can provide broad administrative control if compromised.
Jun 29, 2026
Microsoft released a security update for **CVE-2026-69821**, an important elevation-of-privilege vulnerability in Active Directory Certificate Services (AD CS). A locally authenticated attacker with low privileges could exploit the flaw to obtain **SYSTEM** privileges without user interaction, potentially gaining complete control of an affected Windows host. The vulnerability is associated with **CWE-116**, improper encoding or escaping of output, and carries a CVSS v3.1 base score of **7.8**. Microsoft reported that a fix is available and, at disclosure, had found no public disclosure or evidence of exploitation in the wild; it assessed exploitation as less likely.
Sep 9, 2026
Microsoft patched two actively exploited vulnerabilities in Microsoft Defender and related protection components, including **CVE-2026-41091**, a high-severity local privilege escalation flaw that can give an attacker **`NT AUTHORITY\SYSTEM`** privileges, and **CVE-2026-45498**, a medium-severity denial-of-service issue that can make Defender unavailable. The affected products include Microsoft Malware Protection Engine version **1.1.26030.3008 and earlier** and Microsoft Defender Antimalware Platform version **4.18.26030.3011 and earlier**, and both CVEs were added to CISA’s **Known Exploited Vulnerabilities** catalog due to active exploitation in the wild. Technical analysis of **CVE-2026-41091**, dubbed **RedSun**, says the bug lies in Windows Defender’s file remediation workflow when it processes malicious files marked as Cloud Files placeholders. A standard user can abuse Defender’s SYSTEM-level file operations, together with **NTFS junctions** and **oplocks**, to redirect a privileged write into **`C:\Windows\System32`**, plant a malicious binary such as **`TieringEngineService.exe`**, and then trigger execution through Storage Tiers Management COM activation to obtain a SYSTEM shell. Microsoft said the issues were fixed through automatic updates and urged organizations that disable auto-updates to manually update Defender and any products using the same engine and platform components.
Jul 24, 2026