Microsoft · Configuration Manager
CVE-2024-43468
Microsoft Configuration Manager Remote Code Execution Vulnerability
무엇인가
Microsoft Configuration Manager Remote Code Execution Vulnerability
CISA: Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.
할 일
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
미국 연방 기관 조치 기한: 2026년 3월 5일
Microsoft의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 10. 13. | Command Injection | Windows | 높음 8.8 | 9.8% |
| 2026. 9. 25. | Code Injection | SharePoint | 높음 8.8 | 8.2% |
| 2026. 9. 8. | Link Following | Windows | 높음 7.8 | 0.4% |
| 2026. 9. 8. | Heap-Based Buffer Overflow | Windows | 높음 7.8 | 0.4% |
| 2026. 8. 26. | Remote Code Execution | SQL Server | 높음 8.8 | 57% |
| 2026. 8. 18. | Double Free | Internet Key Exchange (IKE) Service Extensions | 치명적 9.8 | 77% |
| 2026. 8. 18. | Weak Authentication | SharePoint | 치명적 9.1 | 70% |
| 2026. 8. 11. | Windows Ancillary Function Driver for WinSock Use-After-Free | Windows Ancillary Function Driver for WinSock | 높음 7.0 | 0.3% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.