CVE-2026-6516 is an OS command injection vulnerability in Zohocorp ManageEngine ADAudit Plus affecting versions prior to 8606. The flaw exists in the agent API, allowing unauthenticated attackers to execute arbitrary OS commands remotely. This vulnerability is classified under CWE-78 (Improper neutralization of special elements used in an OS command). The CVSS v3.1 base score is 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and complete confidentiality, integrity, and availability impact. As of the published date, no official patch or remediation level has been disclosed by the vendor.

Successful exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands on affected ManageEngine ADAudit Plus servers. This can lead to full system compromise, including complete loss of confidentiality, integrity, and availability of the affected system. Given the critical CVSS score and unauthenticated remote exploitability, this vulnerability poses a severe risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the vulnerable agent API and monitor for suspicious activity related to ManageEngine ADAudit Plus. Avoid exposing the service to untrusted networks. Follow vendor channels closely for updates on patches or official mitigations.