What is the CVSS score of CVE-2026-3182?

CVE-2026-3182 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-3182?

Yes, a patch is available for CVE-2026-3182. Update the affected software to the latest version immediately.

ManageEngine Endpoint Central CVE-2026-3182

EUVD-2026-46154 MEDIUM

Cleartext Transmission of Sensitive Information (CWE-319)

2026-07-21 Zohocorp

GHSA-434m-p5cc-25vp

Information Disclosure Zoho Manageengine Endpoint Central

4.3

CVSS 3.1 · Vendor: Zohocorp

Severity by source

Vendor (Zohocorp) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

PR:L confirmed by authenticated session requirement; C:L reflects credential exposure without full system compromise; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Zohocorp).

CVSS VectorVendor: Zohocorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 21, 2026 - 07:02 EUVD

Analysis Generated

Jul 21, 2026 - 06:02 vuln.today

CVE Published

Jul 21, 2026 - 05:30 cve.org

MEDIUM 4.3

DescriptionCVE.org

Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability.

AnalysisAI

Cleartext transmission of sensitive information in Zohocorp ManageEngine Endpoint Central before version 11.4.2528.34 exposes mail configuration credentials to network interception. Authenticated users who trigger mail-related functionality cause the application to transmit sensitive data - likely SMTP credentials and server configuration - without encryption, making it capturable by any attacker with a network vantage point between the client and server. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 4.3 (Medium) reflects the limited scope and authentication prerequisite.

Technical ContextAI

CWE-319 (Cleartext Transmission of Sensitive Information) describes a root cause where an application transfers data that should be protected - passwords, tokens, configuration secrets - over an unencrypted channel. The vendor reference URL (manageengine.com/.../mail-configuration-data.html) specifically names mail configuration data as the exposed artifact, indicating SMTP server credentials or equivalent mail relay settings are involved. The affected product (CPE: cpe:2.3:a:zohocorp:manageengine_endpoint_central:*:*:*:*:*:*:*:*) is an enterprise unified endpoint management platform; its mail configuration subsystem appears to communicate over HTTP rather than HTTPS for this data path, enabling passive or active interception. The CVSS vector AV:N/PR:L confirms the flaw is exercised over the network by an authenticated session.

RemediationAI

Upgrade ManageEngine Endpoint Central to version 11.4.2528.34 or later, which is the confirmed fixed release per the vendor. The vendor advisory at https://www.manageengine.com/products/desktop-central/mail-configuration-data.html should be reviewed for upgrade instructions and any release notes specific to this fix. As a compensating control prior to patching, restrict network access to the Endpoint Central server to only authorized administrator workstations using host-based or network firewall rules, reducing the window for passive traffic interception - the trade-off is operational overhead and potential disruption to legitimate remote management. Additionally, rotate any SMTP credentials configured in the platform after patching, since previously transmitted values should be treated as potentially compromised. Enforcing TLS on the mail relay path at the network layer (e.g., via a TLS-terminating proxy) can serve as a defense-in-depth measure even after patching.