CVE-2025-55320

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.

CVSS 3.1

6.8CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-25)

CWE

CWE-89

Published

2025-10-14

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• microsoft:configuration_manager_2403
• microsoft:configuration_manager_2409
• microsoft:configuration_manager_2503

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55320

Check your stackJSON