Threat database

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope.

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.

CVE-2026-77697 is a medium severity vulnerability in Zohocorp ManageEngine Endpoint Central that allows improper privilege management leading to privilege escalation during JAR extraction. It affects versions prior to 11.4.2540.23. The vulnerability has a CVSS 3.1 score of 6.3, indicating a locally exploitable issue with low attack complexity but requiring some privileges. No known exploits are reported in the wild, and no official patch information is provided in the source data.

Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component

Zohocorp ManageEngine Endpoint Central versions prior to 11.5.2605.01 contain a local privilege escalation vulnerability due to improper privilege management. The issue arises from loading a DLL from an untrusted path, which can allow a local attacker to escalate privileges. The vulnerability has a medium severity rating with a CVSS score of 5. No official patch or vendor advisory is provided in the input data.

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 contain a local privilege escalation vulnerability related to improper privilege management during agent upgrade. This flaw allows a user with limited privileges to escalate their rights on the affected system. The vulnerability has a medium severity rating with a CVSS score of 5.7. No known exploits are reported in the wild, and the product is not a cloud service.

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.

Zohocorp ManageEngine ADAudit Plus versions before 8606 contain a critical vulnerability (CVE-2026-6516) that allows unauthenticated remote code execution via a vulnerable agent API. This is an OS command injection flaw (CWE-78) that can be exploited without any privileges or user interaction. The vulnerability has a maximum CVSS score of 10. No official patch or remediation guidance is currently provided by the vendor.

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.

Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability.