Threat database

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.

ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.

ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malformed syslog packets.

CVE-2026-86678 is an authorization bypass vulnerability in ZohoCorp ManageEngine Applications Manager versions 182000 and below. It allows a low-privileged user to obtain an administrator's API key and perform administrator-level actions. The vulnerability has a high severity with a CVSS score of 8.8.

CVE-2026-86677 is a high-severity SQL injection vulnerability in ZohoCorp ManageEngine Applications Manager versions prior to 182100. It allows a low-privileged user to execute unauthorized SQL commands, which can lead to administrator access and remote code execution.

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.

ManageEngine Applications Manager versions up to 182200 have a permissions validation vulnerability that allows low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope. This issue is due to missing authentication for a critical function.

ZohoCorp ManageEngine Applications Manager versions prior to 182300 contain a hard-coded Google Cloud service-account private key in the installer. This vulnerability allows unauthenticated attackers to impersonate the service account and potentially access or modify associated cloud resources. The vulnerability is identified as CWE-321 and has a critical CVSS score of 10. A patch is available to remediate this issue.

ManageEngine OpManager MSP versions 12.8.709 and below contain a critical remote code execution vulnerability in the Notification Profile module. This vulnerability is due to improper neutralization of special elements used in OS commands (CWE-78), allowing an attacker with limited privileges to execute arbitrary commands remotely. The flaw affects versions prior to 12.8.711 and has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled contain an authentication bypass vulnerability. This flaw allows attackers with limited privileges to bypass authentication for critical functions, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability is identified as CWE-306 and has a high severity rating with a CVSS score of 8.8.

ManageEngine OpManager and Firewall Analyzer versions up to 12.8.709 contain a command injection vulnerability in the Diagnose Settings feature. This flaw allows improper neutralization of special elements used in OS commands, potentially enabling an attacker with limited privileges to execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 8.8.

ManageEngine OpManager versions 12.8.709 and below contain an XML Injection vulnerability (CWE-91) in the Rule Tracking Compare Policies feature. This vulnerability allows an attacker with low privileges to perform blind XPath injection, potentially leading to unauthorized data disclosure. The vulnerability has a high severity with a CVSS score of 7.7. No known exploits are reported in the wild, and no official patch information is provided in the input data.

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope.