Detections
Analytics
Security Updates for Microsoft Endpoint Configuration Manager (October 2026)
high Nessus Plugin ID 366437
Synopsis
The Microsoft Endpoint Configuration Manager installed on the remote host is affected by multiple vulnerabilities.Description
The Microsoft Endpoint Configuration Manager installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:- Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. (CVE-2026-88075)
- Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
(CVE-2026-70049)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Microsoft has released a security update, please review the vendor advisory.See Also
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70049
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88075
Plugin Details
Severity: High
ID: 366437
File Name: smb_nt_ms26_oct_endpoint_configuration_manager.nasl
Version: 1.2
Type: Local
Agent: windows
Family: Windows : Microsoft Bulletins
Published: 10/16/2026
Updated: 10/16/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 93.15
CVSS v2
Risk Factor: High
Base Score: 9
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-88075
CVSS v3
Risk Factor: High
Base Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:microsoft:endpoint_configuration_manager
Required KB Items: installed_sw/Microsoft Endpoint Configuration Manager
Patch Publication Date: 10/13/2026
Vulnerability Publication Date: 10/13/2026
Reference Information
CVE: CVE-2026-70049, CVE-2026-88075