ManageEngine Applications Manager CVE-2025-9787

Exploitation requires an authenticated session with privileges to write/configure content in the NOC view of ManageEngine Applications Manager (CVSS PR:H), and requires a victim user to subsequently load that NOC view (UI:R) for the stored payload to execute. This is NOT remote-unauthenticated: a low-privilege or anonymous outsider cannot inject the payload. Limiting factors are the privilege prerequisite for storing the script and the dependency on another user rendering the affected NOC dashboard; only versions 177400 and below are affected, and a vendor fix is available.

This is a stored XSS (CWE-79) in the NOC view of ManageEngine Applications Manager. The CVSS 3.1 vector supplied (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) is unusual for XSS: it assigns high privileges-required (PR:H), scope-unchanged (S:U), and full C:H/I:H impact, whereas classic stored XSS is typically modeled as PR:L/N, S:C, C:L/I:L. The stated numeric score of 6.1 is the canonical XSS score, but the given vector actually computes to ~6.5 - a minor internal inconsistency worth noting. Real-world risk is moderate and gated by the PR:H/UI:R preconditions: an attacker must already have sufficient privileges to persist a payload into the NOC view, and a victim operator must then render that view for the script to fire. EPSS of 1.10% (64th percentile) is middling and reflects general interest rather than mass exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a legitimate but non-urgent patch item rather than an active-threat emergency. A vendor patch is available, which materially improves the remediation posture.

An authenticated user with sufficient privileges to edit the NOC (Network Operations Center) view injects a malicious JavaScript payload that is persistently stored. When a monitoring operator or administrator subsequently loads the NOC dashboard, the stored script executes in their browser session, enabling session/credential theft or actions in the victim's authenticated context. No public exploit code is identified at time of analysis.