CVE-2026-77698 is a local privilege escalation vulnerability in Zohocorp ManageEngine Endpoint Central caused by improper privilege management during the agent upgrade process. Versions prior to 11.5.2605.01 are affected. The vulnerability allows a user with limited privileges to escalate their privileges, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS v3.1 score is 5.7, reflecting medium severity with local attack vector, low attack complexity, and required user interaction. No vendor advisory or patch information is currently available.

An attacker with local access and limited privileges could exploit this vulnerability to gain elevated privileges on the affected system. This could lead to partial compromise of system confidentiality, integrity, and availability. The impact is limited to local users and requires user interaction, reducing the overall risk compared to remote or automatic exploits.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local user access and monitor for suspicious activity related to agent upgrades. Avoid running agent upgrades with elevated privileges unless necessary.