# NCSC-NL Advisory: Microsoft System Center Flaws

Published: 2026-10-13 · Severity: routine
Canonical: https://vorant.io/reports/b912734d-92d5-5b17-ab2d-282f78a3b3db/ncsc-nl-advisory-microsoft-system-center-flaws

> NCSC-NL reports privilege escalation and link-following/SQL injection vulnerabilities patched in Microsoft Configuration Manager and Defender products.

NCSC-NL (the Dutch National Cyber Security Center) published a security advisory describing vulnerabilities patched by Microsoft affecting Configuration Manager, Defender for Endpoint, and Defender. The vulnerabilities stem from improper link resolution before file access (link following) and improper neutralization of SQL command elements (SQL injection).

A local attacker could exploit these vulnerabilities to escalate privileges and potentially gain access to sensitive data. The advisory does not indicate active exploitation in the wild. Microsoft has released updates addressing the flaws; no specific CVE identifiers, affected version numbers, or CVSS scores were included in the extracted advisory text, with the source directing readers to the Microsoft Security Response Center portal for full technical details.

Defenders running Microsoft Configuration Manager or Defender products should consult the referenced MSRC portal to identify applicable CVEs and apply the relevant patches. Given the local-access requirement and lack of confirmed in-the-wild exploitation, this should be treated as routine patch management rather than an urgent incident.

## Detection guidance (public sample)

### Junction or Symlink Created Targeting Defender or ConfigMgr Directories

ATT&CK: T1068

Detects mklink or New-Item junction/symlink creation whose command line references Microsoft Defender or Configuration Manager paths, a common primitive for link-following local privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Junction or Symlink Created Targeting Defender or ConfigMgr Directories
description: Detects command-line creation of directory junctions or symbolic links
  (mklink, New-Item -ItemType Junction/SymbolicLink) that reference Microsoft Defender
  or Configuration Manager (CCM) directories. Improper link resolution (link following)
  in privileged services is a known local privilege escalation primitive, and the
  advisory describes such flaws in Configuration Manager and Defender. The advisory
  gives no CVEs or exploit details, so this rule is generic and based on the vulnerability
  class.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection_mklink:
    Image|endswith:
    - \cmd.exe
    CommandLine|contains|all:
    - mklink
    - ' /'
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains|all:
    - New-Item
    - Link
  selection_ps_type:
    CommandLine|contains:
    - Junction
    - SymbolicLink
  selection_target:
    CommandLine|contains:
    - \Windows Defender
    - \Windows Defender Advanced Threat Protection
    - \Microsoft\Windows Defender
    - \CCM\
    - \CCMSetup
    - \SMS_CCM
    - \Microsoft Configuration Manager
  condition: (selection_mklink or (selection_ps and selection_ps_type)) and selection_target
falsepositives:
- Administrators relocating Defender or ConfigMgr cache/log folders with junctions
- Software packaging or lab scripts that create links in ConfigMgr client cache directories
level: medium
id: 44867fbe-a5c7-59d3-be72-6c674e78acd5
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0425.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0425.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b912734d-92d5-5b17-ab2d-282f78a3b3db/ncsc-nl-advisory-microsoft-system-center-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup