CVE-2025-59213 is a high-severity SQL injection vulnerability in Microsoft Configuration Manager versions 2403, 2409, and 2503. This flaw allows an unauthenticated attacker on an adjacent network to achieve privilege escalation. With a CVSS score of 8.8, the vulnerability has a low attack complexity and can lead to complete compromise of confidentiality, integrity, and availability. While there is no public exploit code or KEV listing, the vulnerability has garnered significant community discussion and media coverage, indicating heightened awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.00.9128.1035CPE matchmatch criteria | cpe:2.3:a:microsoft:configuration_manager_2403:*:*:*:*:*:*:*:* | ||
< 5.00.9132.1029CPE matchmatch criteria | cpe:2.3:a:microsoft:configuration_manager_2409:*:*:*:*:*:*:*:* | ||
< 5.00.9135.1008CPE matchmatch criteria | cpe:2.3:a:microsoft:configuration_manager_2503:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.