ManageEngine Applications Manager CVE-2025-6239

Requires a valid authenticated session to the Applications Manager web console (PR:L - any low-privileged user account suffices) and access to the File/Directory monitor feature, which is the specific component that leaks data. Exploitation is limited by the authentication requirement: an unauthenticated external attacker cannot trigger it directly, and environments that restrict console access, enforce least-privilege accounts, or isolate the management interface materially reduce exposure. Affected deployments are those running Applications Manager build 176800 or below.

This is a moderate-severity information disclosure flaw (CVSS 6.5) in ManageEngine Applications Manager's File/Directory monitor. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-complexity exploitation that requires an authenticated low-privileged account (PR:L), with high confidentiality impact but no integrity or availability impact (C:H/I:N/A:N) - consistent with CWE-200. The signals are largely coherent rather than conflicting: EPSS is low at 0.96% (60th percentile), there is no CISA KEV listing, and no public exploit was identified, so this is not evidence of widespread or active exploitation. The one point to weigh is that PR:L means an attacker already needs valid credentials to the monitoring console, which meaningfully constrains real-world risk - this is a post-authentication data-exposure issue, not a pre-auth breach. Overall this reads as a genuine but non-urgent patch-in-maintenance-cycle issue rather than an emergency; the primary concern is that monitoring platforms often hold sensitive infrastructure data, so confidentiality exposure can have outsized downstream value. No KEV/POC conflict exists to flag.

An attacker with a valid low-privileged Applications Manager account abuses the File/Directory monitor functionality to read file or directory contents they should not be able to access, disclosing sensitive system or configuration data. Because the vector is network-based and low-complexity (AV:N/AC:L), this can be performed remotely over the management interface without user interaction. No public exploit code was identified at time of analysis.