undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-16729
Summary
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.
Products covered
Microsoft Configuration Manager 2503
Microsoft Configuration Manager 2509
Microsoft Configuration Manager 2603
Remediation
Release Notes
Vendor-listed fixes
5.00.9135.1042
5.00.9141.1041
5.00.9146.1027
CVEs in this advisory 1
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.