CVE-2026-84791 describes a Broken Access Control vulnerability in ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below. The flaw permits an authenticated user with low privileges to bypass authorization controls and modify Change Management report schedule configurations for firewalls beyond their assigned permissions. This vulnerability is classified under CWE-639 and has a CVSS v3.1 base score of 7.1, indicating high severity. The attack vector is network-based with low attack complexity and requires low privileges but no user interaction. The impact includes high confidentiality impact and low integrity impact, with no availability impact.

An authenticated low-privilege user can modify Change Management report schedule configurations for firewalls outside their assigned scope, potentially exposing sensitive configuration data or disrupting intended firewall reporting processes. The confidentiality impact is high, indicating possible exposure of sensitive information. Integrity impact is low, and availability is not affected.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to ManageEngine OpManager and Firewall Analyzer to trusted users and monitor for unauthorized configuration changes.