Security update for the SMS Provider and administration service

Microsoft KB38982839 fixes security issues in the SMS Provider and the Configuration Manager administration service. The administration service fix is a defense-in-depth measure related to the Windows SMB Server issue CVE-2026-26128.

What changed

The update is available directly for Configuration Manager version 2603 and for versions 2509 and 2503 with the documented update rollups. Installation does not require a computer restart, but it requires a site reset. Existing secondary sites must be updated manually through Recover Secondary Site.

Technical details

SMS Provider security issue
Administration service security issue
Defense-in-depth alignment with Windows SMB Server remediation
Direct 2603 availability plus documented 2509 and 2503 rollup paths

Why it matters

The fixes protect core Configuration Manager provider and administration components. Delaying the update leaves the site exposed to the documented provider and administration service issues and can leave secondary sites at a different update level.

Known limitations

A site reset is required after installation
Preexisting secondary sites require manual recovery in the Configuration Manager console
Install the applicable Windows security update for CVE-2026-26128 as Microsoft recommends

Now check

Confirm the site runs Configuration Manager 2603, or has the required 2509 or 2503 update rollup
Install KB38982839 from Updates and Servicing and complete the required site reset
Verify secondary sites with fnGetSecondarySiteCMUpdateStatus and recover any site that reports value 0
Install the applicable Windows update for CVE-2026-26128