CVE-2026-86679 is a CWE-20 (Improper Input Validation) vulnerability affecting ZohoCorp ManageEngine Applications Manager versions up to 182000. The flaw permits a low-privileged user to bypass permissions restrictions and delete service monitors that are outside their assigned scope. This vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with an attack vector of network, low attack complexity, and requiring low privileges without user interaction. The impact is limited to integrity and availability, with no confidentiality impact.

Exploitation allows unauthorized deletion of service monitors by low-privileged users, potentially disrupting monitoring operations and affecting service availability and integrity. There is no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict low-privileged user permissions as much as possible to limit exposure.