CVE-2025-47179 is an improper access control vulnerability in Microsoft Configuration Manager versions 2403, 2409, and 2503, allowing an authenticated attacker to locally elevate privileges. With a CVSS score of 6.7 (Medium), it requires high privileges and local access, but no user interaction, to achieve high impact on confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion and media coverage, indicating awareness within the cybersecurity landscape.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.00.9128.1037CPE matchmatch criteria | cpe:2.3:a:microsoft:configuration_manager_2403:*:*:*:*:*:*:*:* | ||
< 5.00.9132.1031CPE matchmatch criteria | cpe:2.3:a:microsoft:configuration_manager_2409:*:*:*:*:*:*:*:* | ||
< 5.0.9135.1013CPE matchmatch criteria | cpe:2.3:a:microsoft:configuration_manager_2503:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.