CVE-2025-47178

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to execute code over an adjacent network.

Score

CVSS 3.1 8.0 High

Status

Analyzed - secure@microsoft.com

Published

2025-07-08

Last modified

2026-02-26

Weaknesses

CWE-89

Affected products

• Configuration Manager 2503 (Microsoft)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47178