What is the CVSS score of CVE-2026-6516?

CVE-2026-6516 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 4.7%.

Which versions of ManageEngine ADAudit Plus are affected by CVE-2026-6516?

ManageEngine ADAudit Plus versions before build 8606 contain a critical, unauthenticated remote code execution vulnerability in the agent API that allows attackers to execute arbitrary OS commands…. A patch is available.

How to fix or mitigate CVE-2026-6516?

Within 24 hours, identify all ManageEngine ADAudit Plus deployments and their build versions (any build before 8606 is vulnerable); immediately restrict network access to the agent API to trusted internal networks only and disable any external or internet-facing connectivity to it. Within 7 days, upgrade to ADAudit Plus build 8606 or later once released by the vendor and apply the patch immediately upon availability; contact Zohocorp support to confirm patch release timeline. Within 30 days, verify all instances are running build 8606 or later, gradually restore production network policies while monitoring API logs for exploitation attempts, and conduct a post-incident security assessment to determine if any system compromise occurred during the vulnerable exposure window.

ManageEngine ADAudit Plus CVE-2026-6516

EUVD-2026-48337 CRITICAL

OS Command Injection (CWE-78)

2026-07-23 Zohocorp

GHSA-3wh2-2f78-vx7j

RCE Command Injection Zoho Manageengine Adaudit Plus Zohocorp

10.0

CVSS 3.1 · Vendor: Zohocorp

Severity by source

Vendor (Zohocorp) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable command injection with no interaction gives AV:N/AC:L/PR:N/UI:N; RCE as the service account yields full C:H/I:H/A:H, and I score S:U as host-local compromise absent clear evidence of cross-security-authority impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Zohocorp).

CVSS VectorVendor: Zohocorp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 23, 2026 - 19:03 EUVD

Analysis Generated

Jul 23, 2026 - 18:21 vuln.today

CVE Published

Jul 23, 2026 - 17:22 cve.org

CRITICAL 10.0

DescriptionCVE.org

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

AnalysisAI

Remote code execution in Zohocorp ManageEngine ADAudit Plus (all builds before 8606) allows unauthenticated attackers to run arbitrary OS commands by abusing the product's agent API, which fails to sanitize input passed to a shell (CWE-78). Rated CVSS 10.0 by the vendor with a scope-changing vector, the flaw requires no privileges or user interaction and reaches the network-exposed agent communication channel directly. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity and unauthenticated nature make it a high-priority patch for any exposed deployment.

Technical ContextAI

ADAudit Plus is Zohocorp/ManageEngine's Active Directory, file server, and Windows auditing/UEBA platform; it uses lightweight agents deployed on monitored domain controllers and member servers that report back to the central server over an agent API. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e., OS command injection), meaning attacker-controlled data reaching the agent API is incorporated into a shell/command invocation without proper sanitization, allowing arbitrary command execution. The affected CPE is cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*, covering all versions prior to build 8606. Because AD auditing agents and servers typically run with elevated (often SYSTEM or domain-privileged service) rights, code execution here tends to yield high-value access within an Active Directory environment.

RemediationAI

Vendor-released patch: upgrade ManageEngine ADAudit Plus to build 8606 or later, which remediates the vulnerable agent API; follow the upgrade guidance in the vendor advisory at https://www.manageengine.com/products/active-directory-audit/cve-2026-6516.html. Until the upgrade is applied, reduce exposure of the agent API by restricting network access to the ADAudit Plus server and its agent communication ports to only trusted management subnets and known agent hosts (via host firewall or network ACLs), and ensure the server is not reachable from the internet - the trade-off is that any legitimately remote or roaming agents may fail to report until allow-listed. Because the product runs with elevated privileges, also consider temporarily isolating the ADAudit Plus host and monitoring it for anomalous child-process/command execution as a detection compensating control. Do not rely on these network controls as a permanent substitute for build 8606.