CVE-2026-77698: CWE-269: Improper Privilege Management in Zohocorp ManageEngine Endpoint Central

CVE-2026-77698 is a local privilege escalation vulnerability in Zohocorp ManageEngine Endpoint Central affecting versions prior to 11.5.2605.01. The issue arises from improper privilege management during the agent upgrade process, classified under CWE-269. An attacker with local access and limited privileges could exploit this flaw to gain elevated privileges, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS v3.1 base score is 5.7, reflecting medium severity with local attack vector, low attack complexity, and required user interaction.

Successful exploitation allows a local user with limited privileges to escalate their privileges on the affected system. This could lead to partial compromise of system confidentiality, integrity, and availability. However, exploitation requires local access and user interaction, limiting the attack scope.

A fix is available in ManageEngine Endpoint Central version 11.5.2605.01 and later. Users should upgrade to this version or newer to remediate the vulnerability. No additional mitigation guidance is provided by the vendor. Patch status is confirmed by the affectedVersions field indicating versions before 11.5.2605.01 are vulnerable.