CVE-2026-77697 is a privilege escalation vulnerability in Zohocorp ManageEngine Endpoint Central affecting versions prior to 11.4.2540.23. The issue arises from improper privilege management during the extraction of JAR files, which could allow an attacker with limited privileges to escalate their privileges. The CVSS 3.1 base score is 6.3 (medium), with attack vector local, low attack complexity, low privileges required, no user interaction, scope changed, and impacts on confidentiality, integrity, and availability rated low to medium.

An attacker with some local access and low privileges could exploit this vulnerability to escalate their privileges on the affected system. This could lead to limited compromise of confidentiality, integrity, and availability of the system. However, the impact is considered medium severity and there are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates and consider restricting local access to trusted users only.