EUVD-2026-82655
GHSA-qc75-qh59-qwjw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DataSecurity Plus agent endpoint over network
-
ExploitCraft request bypassing agent enrollment/auth
-
ExecutionServer accepts unauthenticated agent request
-
ImpactSubmit/retrieve data as trusted agent
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires network reachability to the DataSecurity Plus server's agent communication interface and the ability to send agent-style requests without completing agent enrollment/authentication. Limiting factors: the vendor's AC:H rating indicates meaningful preconditions (likely knowledge of the proprietary agent protocol/endpoints or specific request structure), and the flaw is fixed in build 6310 so only deployments before 6310 are exposed. No user interaction and no prior authentication are required per the CVSS vector, but the concrete confidentiality/integrity impact of an accepted unauthenticated agent request is not detailed in the advisory. |
| Impact | This is a moderate-priority issue whose real-world risk is hard to pin down because the vendor advisory is the only source and the description is terse. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, 7.5) signals a remote, unauthenticated flaw but with high attack complexity, which tempers urgency. Exploitation signals are all absent/unknown: EPSS is not provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced - so this is 'no public exploit identified at time of analysis,' not active exploitation. There is internal tension in the vendor scoring: an 'agent authentication bypass' described only as 'send requests without proper authentication' provides little evidence for either the Scope change (S:C) or the High confidentiality impact (C:H) the vendor assigned, and auth-bypass flaws are typically low-complexity (AC:L) rather than AC:H - verify concrete impact with ManageEngine. Net: a legitimate patch-worthy authentication weakness, but the 7.5 rating leans on impact/scope assumptions the public description does not substantiate. |
| Exploit ScenarioDerived | An attacker on a network path to the DataSecurity Plus server crafts agent-protocol requests that impersonate or act as an agent without completing enrollment/authentication, causing the server to accept and process requests from an untrusted source. No public proof-of-concept is referenced, and the vendor's AC:H rating implies non-trivial conditions (e.g., knowledge of the agent protocol/endpoints) are needed to succeed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
An authentication bypass in ManageEngine DataSecurity Plus deployments running builds earlier than 6310 allows unenrolled agents to send requests to the server's agent communication interface without completing enrollment or authentication, potentially exposing or altering the data that interface handles. The vulnerability is remotely reachable and requires no user interaction and no prior authentication (CVSS vector PR:N/UI:N), though the vendor's AC:H rating and our own lower independent assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicate the practical impact is modest and gated by preconditions such as knowledge of the proprietary agent request format. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so active exploitation is unconfirmed; the risk is hard to pin down because the vendor advisory is the only source and the description is terse.
RemediationAI
Upgrade ManageEngine DataSecurity Plus to build 6310 or later, which is the vendor-released fix for this issue per the advisory at https://www.manageengine.com/data-security/cve-2026-18911.html; confirm the running build number on the server after upgrading rather than assuming the update applied. Because the flaw is reachable through the agent communication interface and is unauthenticated per the CVSS vector, a useful compensating control while patching is to restrict network access to that interface so only legitimate, enrolled agent hosts can reach it - via host firewall rules, network segmentation, or an allowlist at the perimeter - accepting that this breaks agent communication from any host not explicitly permitted and adds management overhead for roaming or dynamic endpoints. Additionally, monitor server and agent-interface logs for requests from unenrolled or unrecognized agent identities, and treat any such entries as suspicious, understanding that this is detection rather than prevention and generates false positives during legitimate agent rollouts or re-enrollment. No vendor workaround short of upgrading is documented; do not rely on disabling the agent interface unless endpoint monitoring coverage can be sacrificed, as that removes the product's core telemetry function.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-20 (Improper Input Validation) and sits in the agent-facing communication component of ManageEngine DataSecurity Plus, Zoho Corp's endpoint data-loss-prevention and compliance monitoring product. The server is expected to accept agent requests only from endpoints that have completed agent enrollment and authenticated; per the advisory, requests from unenrolled agents are processed without proper authentication, meaning the server fails to validate the enrollment/authentication state of the inbound request before acting on it. The affected product is identified in the CPE data as cpe:2.3:a:zohocorp:manageengine_datasecurity_plus:*:*:*:*:*:*:*:* (all versions of the product, with the fix defining the boundary at build 6310). The vendor's CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) implies a scope change and high confidentiality impact with only low integrity impact, while our independent assessment applies S:U and lowers confidentiality to L:U-aligned low, reflecting that the advisory provides no concrete detail on what an accepted unauthenticated agent request can actually read or change. The AC:H element in the vendor score is consistent with meaningful preconditions, most plausibly knowledge of the proprietary agent protocol, endpoint paths, or request structure required to craft an accepted agent-style request.
Know when Manageengine Datasecurity Plus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Unauthenticated network auth-bypass (PR:N, AC:L for a bypass); vague description supports only limited C:L/I:L and no evidence for scope change, so S:U.
Primary rating from Vendor (Zohocorp).
CVSS VectorVendor: Zohocorp
Lifecycle Timeline
2DescriptionCVE.org
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.
Executive ViewAI
ManageEngine DataSecurity Plus deployments running builds earlier than 6310 are exposed to a high-severity authentication bypass in the agent communication interface, allowing unauthenticated remote requests that could expose or alter data handled by that interface. No public exploit identified at time of analysis, but the affected product supports sensitive data security and compliance workflows, so leadership should prioritize inventory, network restriction, and vendor coordination until a permanent fix is available.
No vendor-released patch identified at time of analysis; interim controls include restricting the agent communication interface to trusted agent IPs/subnets, segmenting the DataSecurity Plus server from untrusted networks, disabling or limiting unenrolled agent request paths if configurable, monitoring for anomalous or unenrolled agent traffic, and applying vendor workarounds when published.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode
The DataEngine Xnode Server application in Zoho ManageEngine DataSecurity Plus prior to 6.0.1 does not validate the data
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys bein
Authenticated remote code execution affects Zoho ManageEngine ADSelfService Plus (before build 6525), DataSecurity Plus
Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and bel
Authenticated SQL injection in ManageEngine DataSecurity Plus builds before 6310 allows a technician-level user to execu
An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. Rated medium severity (CVSS 4.3), this
Exploit-DB