CISA flags critical Microsoft SCCM flaw as exploited in attacks

CISA has ordered U.S. federal agencies to urgently patch Microsoft Configuration Manager for CVE-2024-43468, a critical unauthenticated SQL injection that can lead to remote code execution; Synacktiv published PoC exploit code in November 2024 and CISA now reports active in-the-wild exploitation, prompting immediate mitigation under BOD 22-01.