VORANT. Threat Intelligence Research Sign in Create a free account

NCSC-NL Advisory: Microsoft System Center Flaws

routine vulnerability

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

NCSC-NL reports privilege escalation and link-following/SQL injection vulnerabilities patched in Microsoft Configuration Manager and Defender products.

NCSC-NL (the Dutch National Cyber Security Center) published a security advisory describing vulnerabilities patched by Microsoft affecting Configuration Manager, Defender for Endpoint, and Defender. The vulnerabilities stem from improper link resolution before file access (link following) and improper neutralization of SQL command elements (SQL injection).

A local attacker could exploit these vulnerabilities to escalate privileges and potentially gain access to sensitive data. The advisory does not indicate active exploitation in the wild. Microsoft has released updates addressing the flaws; no specific CVE identifiers, affected version numbers, or CVSS scores were included in the extracted advisory text, with the source directing readers to the Microsoft Security Response Center portal for full technical details.

Defenders running Microsoft Configuration Manager or Defender products should consult the referenced MSRC portal to identify applicable CVEs and apply the relevant patches. Given the local-access requirement and lack of confirmed in-the-wild exploitation, this should be treated as routine patch management rather than an urgent incident.

Related reporting

Detection guidance

Junction or Symlink Created Targeting Defender or ConfigMgr Directories

ATT&CK T1068

Detects mklink or New-Item junction/symlink creation whose command line references Microsoft Defender or Configuration Manager paths, a common primitive for link-following local privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Junction or Symlink Created Targeting Defender or ConfigMgr Directories
description: Detects command-line creation of directory junctions or symbolic links
  (mklink, New-Item -ItemType Junction/SymbolicLink) that reference Microsoft Defender
  or Configuration Manager (CCM) directories. Improper link resolution (link following)
  in privileged services is a known local privilege escalation primitive, and the
  advisory describes such flaws in Configuration Manager and Defender. The advisory
  gives no CVEs or exploit details, so this rule is generic and based on the vulnerability
  class.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_mklink:
    Image|endswith:
    - \cmd.exe
    CommandLine|contains|all:
    - mklink
    - ' /'
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains|all:
    - New-Item
    - Link
  selection_ps_type:
    CommandLine|contains:
    - Junction
    - SymbolicLink
  selection_target:
    CommandLine|contains:
    - \Windows Defender
    - \Windows Defender Advanced Threat Protection
    - \Microsoft\Windows Defender
    - \CCM\
    - \CCMSetup
    - \SMS_CCM
    - \Microsoft Configuration Manager
  condition: (selection_mklink or (selection_ps and selection_ps_type)) and selection_target
falsepositives:
- Administrators relocating Defender or ConfigMgr cache/log folders with junctions
- Software packaging or lab scripts that create links in ConfigMgr client cache directories
level: medium
id: 44867fbe-a5c7-59d3-be72-6c674e78acd5
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0425.html

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0425.html

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs