ManageEngine Endpoint Central CVE-2025-5496

Requires pre-existing low-privileged local access on a host running the ManageEngine Endpoint Central agent, and that host must be running an agent build earlier than 11.4.2508.14, 11.4.2516.06, or 11.4.2518.01. Exploitation targets the agent setup component to delete attacker-chosen files; the realistic value comes from deleting a file the higher-privileged agent service depends on to achieve local privilege escalation. Exploitation is strictly LIMITED by the local attack vector (no remote/network path, AV:L) and the requirement for an authenticated low-privilege foothold (PR:L); no user interaction by a victim is required (UI:N).

This is a genuinely low-priority vulnerability by every available signal, and the signals are internally consistent. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) describes a local, low-complexity flaw that already requires a foothold with low privileges on the host - it is not remotely reachable. The base score of 3.3 (Low) reflects that only a limited integrity impact is scored, even though the vendor KB frames the outcome as local privilege escalation; there is some tension here, because an arbitrary-file-deletion primitive that enables privilege escalation would in practice also carry an availability impact and a higher post-escalation integrity impact than the I:L the vendor assigned - verify impact scope against the vendor KB. No EPSS score, KEV listing, SSVC decision, or POC indicator was provided in the input. There is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a legitimate defense-in-depth patch for endpoint-management fleets, but not an emergency - prioritize behind internet-facing and unauthenticated issues.

A low-privileged local user (or malware already running in a standard user context) on a machine running the ManageEngine Endpoint Central agent abuses the agent setup component to delete arbitrary files that it should not be able to touch. By deleting or replacing a file that the higher-privileged agent service relies on, the attacker converts the deletion primitive into local privilege escalation. No public exploit code was identified in the provided data.