Edit

Security update for the SMS Provider and administration service

Applies to: Configuration Manager (current branch, version 2603, and versions 2509 and 2503 with update rollup installed)

Summary of KB38982839

This update fixes the following security issues in Configuration Manager:

  • An issue with the SMS Provider.
  • An issue with the administration service. This is a defense-in-depth fix related to a Windows SMB Server issue, addressed separately by CVE-2026-26128. We strongly recommend that you also install the applicable Windows security update.

Hotfixes that are included in this update

For Configuration Manager version 2503:

  • KB 37447175: Security update to harden access to Network Access Account information

Update information for Microsoft Configuration Manager current branch

This update is available in the Updates and Servicing node of the Configuration Manager console for version 2603 directly, and for versions 2509 and 2503 with the following update rollups installed:

  • KB 37864969: Second update rollup for Microsoft Configuration Manager version 2509
  • KB 32851084: Update rollup for Microsoft Configuration Manager version 2503

Restart information

This update doesn't require a computer restart, but does require a site reset after installation.

Additional installation information

After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select Administration > Site Configuration > Sites > Recover Secondary Site, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. This reinstallation doesn't affect configurations and settings for the secondary site. New, upgraded, and reinstalled secondary sites under that primary site automatically receive this update.

Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:

select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')

If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site.

If the value 0 is returned, all the fixes that are applied to the primary site aren't installed for the secondary site. Use the Recover Secondary Site option to update the secondary site.

File information

File information is available in the following downloadable text files:

Release history

  • August 2026: Initial hotfix release

References

  • Last updated on