Microsoft Configuration Manager
GeneralSecurity update for the SMS Provider and administration service
In brief
The new page documents security fixes for the SMS Provider and administration service, applicable to Configuration Manager versions 2603, 2509, and 2503 with required rollups. Installation requires a site reset and manual updating of existing secondary sites.
What Intune admins need to know
Administrators should install the update through Updates and Servicing, perform the required site reset, and use Recover Secondary Site to update secondary sites.
This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
new file mode 100644
title: Security update for the SMS Provider and administration service description: Security update for the SMS Provider and administration service ms.date: 08/17/2026 ms.subservice: core-infra ms.topic: reference ms.service: configuration-manager
Security update for the SMS Provider and administration service
Applies to: Configuration Manager (current branch, version 2603, and versions 2509 and 2503 with update rollup installed)
Summary of KB38982839
This update fixes the following security issues in Configuration Manager:
- An issue with the SMS Provider.
- An issue with the administration service. This is a defense-in-depth fix related to a Windows SMB Server issue, addressed separately by CVE-2026-26128. We strongly recommend that you also install the applicable Windows security update.
Hotfixes that are included in this update
For Configuration Manager version 2503:
- KB 37447175: Security update to harden access to Network Access Account information
Update information for Microsoft Configuration Manager current branch
This update is available in the Updates and Servicing node of the Configuration Manager console for version 2603 directly, and for versions 2509 and 2503 with the following update rollups installed:
- KB 37864969: Second update rollup for Microsoft Configuration Manager version 2509
- KB 32851084: Update rollup for Microsoft Configuration Manager version 2503
Restart information
This update doesn't require a computer restart, but does require a site reset after installation.
Additional installation information
After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select Administration > Site Configuration > Sites > Recover Secondary Site, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. This reinstallation doesn't affect configurations and settings for the secondary site. New, upgraded, and reinstalled secondary sites under that primary site automatically receive this update.
Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:
select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')
If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site.
If the value 0 is returned, all the fixes that are applied to the primary site aren't installed for the secondary site. Use the Recover Secondary Site option to update the secondary site.
File information
File information is available in the following downloadable text files:
Release history
- August 2026: Initial hotfix release
References
@@ -0,0 +1,66 @@+---+title: Security update for the SMS Provider and administration service+description: Security update for the SMS Provider and administration service+ms.date: 08/17/2026+ms.subservice: core-infra+ms.topic: reference+ms.service: configuration-manager+---++# Security update for the SMS Provider and administration service++*Applies to: Configuration Manager (current branch, version 2603, and versions 2509 and 2503 with update rollup installed)*++## Summary of KB38982839++This update fixes the following security issues in Configuration Manager:++- An issue with the SMS Provider.+- An issue with the administration service. This is a defense-in-depth fix related to a Windows SMB Server issue, addressed separately by [CVE-2026-26128](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26128). We strongly recommend that you also install the applicable Windows security update.++## Hotfixes that are included in this update++For Configuration Manager version 2503:++- KB [37447175](../../hotfix/2503/37447175.md): Security update to harden access to Network Access Account information++### Update information for Microsoft Configuration Manager current branch++This update is available in the **Updates and Servicing** node of the Configuration Manager console for version 2603 directly, and for versions 2509 and 2503 with the following update rollups installed:++- KB [37864969](../../hotfix/2509/37864969.md): Second update rollup for Microsoft Configuration Manager version 2509+- KB [32851084](../../hotfix/2503/32851084.md): Update rollup for Microsoft Configuration Manager version 2503++### Restart information++This update doesn't require a computer restart, but does require a [site reset](../../core/servers/manage/modify-your-infrastructure.md#bkmk_reset) after installation.++### Additional installation information++After you install this update on a primary site, preexisting secondary sites must be manually updated. To update a secondary site in the Configuration Manager console, select **Administration** > **Site Configuration** > **Sites** > **Recover Secondary Site**, and then select the secondary site. The primary site then reinstalls that secondary site by using the updated files. This reinstallation doesn't affect configurations and settings for the secondary site. New, upgraded, and reinstalled secondary sites under that primary site automatically receive this update.++Run the following SQL Server command on the site database to check whether the update version of a secondary site matches that of its parent primary site:++```sql+select dbo.fnGetSecondarySiteCMUpdateStatus ('SiteCode_of_secondary_site')+```++If the value 1 is returned, the site is up to date, with all the hotfixes applied on its parent primary site.++If the value 0 is returned, all the fixes that are applied to the primary site aren't installed for the secondary site. Use the **Recover Secondary Site** option to update the secondary site.++## File information++File information is available in the following downloadable text files:++- [KB38982839_2503_FileList.txt](https://aka.ms/KB38982839_2503_FileList)+- [KB38982839_2509_FileList.txt](https://aka.ms/KB38982839_2509_FileList)+- [KB38982839_2603_FileList.txt](https://aka.ms/KB38982839_2603_FileList)++## Release history++- August 2026: Initial hotfix release++## References++- [Updates and servicing for Configuration Manager](../../core/servers/manage/updates.md)