Skip to content

CVE-2024-43468

SQL Injection in Microsoft Configuration Manager. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 12 February 2026.

Product
Microsoft Configuration Manager
Added to CISA's catalog
Federal fix-by date
Ransomware
No known use in ransomware campaigns
Vendor advisories
Sources
CISA’s catalog, NVD entry

CISA’s description.

Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.

More from Microsoft this year.

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 30 October 2026.