Security update for the SMS Provider and administration service

Applies to: Configuration Manager (current branch, version 2603, and versions 2509 and 2503 with update rollup installed)

Important

This update is superseded by KB 39398030.

Summary of KB38982839

This update fixes the following security issues in Configuration Manager:

  • An issue with the SMS Provider. This update addresses the elevation of privilege vulnerability described in CVE-2026-88075.
  • An issue with the administration service. This is a defense-in-depth fix related to a Windows SMB Server issue, addressed separately by CVE-2026-26128. We strongly recommend that you also install the applicable Windows security update.

Note

For Configuration Manager version 2603, this update is included with the update rollup for Configuration Manager version 2603 KB 39169655. A separate out of band hotfix isn't required after you install the update rollup.

Hotfixes that are included in this update

For Configuration Manager version 2503:

  • KB 37447175: Security update to harden access to Network Access Account information

Update information for Microsoft Configuration Manager current branch

This update is available in the Updates and Servicing node of the Configuration Manager console for version 2603 directly, and for versions 2509 and 2503 with the following update rollups installed:

  • KB 37864969: Second update rollup for Microsoft Configuration Manager version 2509
  • KB 32851084: Update rollup for Microsoft Configuration Manager version 2503

Restart information

This update doesn't require a computer restart, but does require a site reset after installation.

Additional installation information

After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select Administration > Site Configuration > Sites > Recover Secondary Site, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. This reinstallation doesn't affect configurations and settings for the secondary site. New, upgraded, and reinstalled secondary sites under that primary site automatically receive this update.

Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:

select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')

If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site.

If the value 0 is returned, all the fixes that are applied to the primary site aren't installed for the secondary site. Use the Recover Secondary Site option to update the secondary site.

File information

File information is available in the following downloadable text files:

Release history

  • September 2026: Added inclusion information for KB 39169655
  • August 2026: Initial hotfix release
  • August 2026: Added supersedence information for KB 39398030

References

  • Last updated on