A staggering 15,465 public servers running Microsoft’s Configuration Manager (MCP) software have been found to be vulnerable to identity exposure attacks, leaving millions of users potentially open to cyber threats. These compromised servers could allow attackers to traverse through various domains and systems, essentially creating a pathway for more severe breaches.
The MCP servers, responsible for managing system settings and updates on Windows devices, are typically used in enterprise environments. However, many organizations have inadvertently left these servers exposed online, making them susceptible to unauthorized access. The issue stems from the servers’ default configuration, which allows users with administrative privileges to obtain sensitive information about other domains within the network.
When an attacker gains access to a public MCP server, they can use it as a “jumping-off point” to map out the underlying domain structure and identify potential vulnerabilities. This process is called privilege escalation. By exploiting these weaknesses, attackers can then move laterally across the network, essentially creating a pathway for more severe breaches.
One of the primary concerns with this issue is that many organizations are unaware they have public MCP servers exposed online. A significant number of these servers were found to be located in sensitive sectors such as government and finance. Furthermore, some of the affected servers belonged to educational institutions, potentially putting student data at risk.
The widespread nature of this vulnerability highlights a critical issue: inadequate network configuration. Many organizations rely on default settings for their MCP servers, leaving them vulnerable to attacks. This is especially concerning given that these servers often have access to sensitive information about the organization’s internal systems and networks.
As a result of this discovery, it’s essential for IT administrators to take immediate action and review their server configurations. Regular security audits should be performed to identify exposed servers and ensure they are properly secured.
Source: The Hacker News — 2026-10-06