CVE-2026-85640: CWE-269: Improper Privilege Management in Zohocorp ManageEngine Endpoint Central

This vulnerability, tracked as CVE-2026-85640, involves improper privilege management (CWE-269) in Zohocorp ManageEngine Endpoint Central. Versions below 11.5.2600.15 are affected by a privilege escalation issue caused by an outdated component. The CVSS 3.1 base score is 6.3 with attack vector local, low attack complexity, requiring low privileges, no user interaction, and scope changed. The impact includes low confidentiality, integrity, and availability impacts. No known exploits are reported in the wild. The vendor has not provided a remediation level or patch information at this time.

Successful exploitation could allow a local attacker with some privileges to escalate their privileges further on the affected system. The impact includes limited confidentiality, integrity, and availability loss. There are no known active exploits in the wild. The vulnerability requires local access and low complexity to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for unusual privilege escalation attempts. Follow vendor updates closely for any forthcoming patches or mitigation instructions.