CISA ordered U.S. government agencies on Thursday to secure their systems against a critical Microsoft Configuration Manager vulnerability patched in October 2024 and now exploited in attacks.

Microsoft Configuration Manager (also known as ConfigMgr and formerly System Center Configuration Manager, or SCCM) is an IT administration tool for managing large groups of Windows servers and workstations.

Tracked as CVE-2024-43468 and reported by offensive security company Synacktiv, this SQL injection vulnerability allows remote attackers with no privileges to gain code execution and run arbitrary commands with the highest level of privileges on the server and/or the underlying Microsoft Configuration Manager site database.

"An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database," Microsoft explained when it patched the flaw in October 2024.

At the time, Microsoft tagged it as "Exploitation Less Likely," saying that "an attacker would likely have difficulty creating the code, requiring expertise and/or sophisticated timing, and/or varied results when targeting the affected product."

However, Synacktiv shared proof-of-concept exploitation code for CVE-2024-43468 on November 26th, 2024, almost two months after Microsoft released security updates to mitigate this remote code execution vulnerability.

While Microsoft has not yet updated its advisory with additional information, CISA has now flagged CVE-2024-43468 as actively exploited in the wild and has ordered Federal Civilian Executive Branch (FCEB) agencies to patch their systems by March 5th, as mandated by the Binding Operational Directive (BOD) 22-01.

"These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," the U.S. cybersecurity agency warned.

"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."

Even though BOD 22-01 applies only to federal agencies, CISA encouraged all network defenders, including those in the private sector, to secure their devices against ongoing CVE-2024-43468 attacks as soon as possible.