Microsoft Configuration Manager Authentication Bypass Vulnerability Allowing Spoofing

A vulnerability in Microsoft Configuration Manager has been identified, allowing authentication bypass by spoofing. This issue enables an authorized attacker to impersonate users over an adjacent network. The vulnerability arises because Active Directory user accounts with certain user principal names (UPNs) were not properly synchronized to Microsoft Entra ID, creating an opportunity for spoofing attacks.

Impact

Exploitation of this vulnerability could allow an attacker to gain unauthorized administrative control over Microsoft Configuration Manager and its managed clients.

Remediation

Users can download the security update for Microsoft Configuration Manager version 2409, 2503, or 2403 through the Microsoft Endpoint Configuration Manager update center.