EUVD-2026-85233
GHSA-prpv-x87v-q3xv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SQLi in a web feature needing only a low-privilege account (PR:L, AV:N, AC:L, UI:N); database injection yields full C:H/I:H/A:H with no scope change.
Primary rating from Vendor (Zohocorp).
CVSS VectorVendor: Zohocorp
Lifecycle Timeline
4DescriptionCVE.org
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.
AnalysisAI
SQL injection in the Rule Management Search Reports feature of ManageEngine OpManager and Firewall Analyzer 12.8.669 and earlier allows a remote, authenticated low-privilege user to inject arbitrary SQL through a search parameter, giving them database read and write capability with high confidentiality, integrity, and availability impact (CVSS 3.1: 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is rated CVSS 8.8 and affects on-premises ITOM deployments exposing the web console; exploitation requires prior possession of valid credentials at any privilege tier, so it is not a pre-authentication flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privilege account (PR:L) on ManageEngine OpManager or Firewall Analyzer version 12.8.669 or below, and network access to the web console (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely serious, actionable vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ManageEngine OpManager and ManageEngine Firewall Analyzer to version 12.8.670 or later, which is the vendor-released fix and removes the vulnerable search path; installations on 12.8.669 or any earlier build should be treated as exposed until that upgrade is applied, and the vendor advisory at https://www.manageengine.com/itom/advisory/cve-2026-14913.html should be consulted for product-specific build notes and upgrade order. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every on-premises instance of OpManager and Firewall Analyzer, confirm which are running 12.8.669 or earlier, and determine whether their web consoles are reachable from untrusted networks; where exposure is confirmed, restrict console access to trusted management segments and review user accounts for unnecessary or stale low-privilege credentials, since the flaw requires only authenticated access at any privilege tier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today