CVE-2026-77699: CWE-269: Improper Privilege Management in Zohocorp ManageEngine Endpoint Central

CVE-2026-77699 is a local privilege escalation vulnerability in Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01. It is caused by improper privilege management (CWE-269) where the software loads a DLL from an untrusted path. This flaw can be exploited by a local attacker to gain elevated privileges on the affected system. The CVSS 3.1 base score is 5.0, indicating medium severity, with attack vector local, high attack complexity, low privileges required, and user interaction required. The impact includes limited confidentiality, integrity, and availability impacts.

An attacker with local access to a vulnerable system can exploit this flaw to escalate privileges, potentially gaining higher-level access than intended. This could lead to limited compromise of system confidentiality, integrity, and availability. However, exploitation requires local access and user interaction, and the attack complexity is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is provided in the input data, users should monitor Zohocorp's official channels for updates. Until a fix is available, restrict local access to trusted users and consider applying any available workarounds recommended by the vendor.