CVE-2026-12370 is a Server-Side Template Injection vulnerability in ZohoCorp's ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager products. The vulnerability arises from improper neutralization of special elements used in the template engine during Configlet processing, classified under CWE-1336. It affects versions 12.8.667 and earlier, potentially allowing an attacker with low privileges to execute remote code on the server. The CVSS v3.1 base score is 7.6, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality and availability impact.

Successful exploitation could lead to remote code execution on the affected system, compromising confidentiality and availability. The attacker requires low privileges and no user interaction, increasing the risk in environments where these products are deployed. There are no known exploits in the wild at this time.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, restrict access to the affected services and monitor for suspicious activity related to Configlet processing.