ManageEngine OpManager CVE-2026-76978

Requires an authenticated low-privilege account (PR:L) on a ManageEngine OpManager or Firewall Analyzer instance at version 12.8.709 or below, plus network reachability to the web management interface. The vulnerable surface is the Diagnose Settings feature specifically, where user-supplied input reaches an OS command without sufficient sanitization. No user interaction is needed (UI:N) and no special non-default configuration is called out - the Diagnose Settings feature is part of the standard product. The authentication requirement is the primary limiting factor; exposure of the management console to untrusted networks materially increases risk.

This is a genuine high-priority finding. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) is internally consistent with a CWE-78 OS command injection: network-reachable, low attack complexity, only low-privilege authentication required, no user interaction, and full confidentiality/integrity/availability impact because command injection yields code execution on the host. Exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC referenced, so there is no evidence of active or widespread exploitation yet. No SSVC decision data was provided. The main caveat is that the only source is the vendor's own advisory (Zoho self-reported); NVD enrichment, EPSS, and independent confirmation are absent. Note also that PR:L means this is NOT unauthenticated - an attacker needs at least a low-privilege account, which meaningfully constrains real-world exploitability compared to a pre-auth RCE, though credentials for monitoring appliances are frequently weak, shared, or obtainable via other flaws in the same product.

An attacker holding a low-privilege account on a ManageEngine OpManager or Firewall Analyzer instance navigates to the Diagnose Settings feature and injects shell metacharacters into a parameter that is passed to an OS command, causing arbitrary commands to execute with the privileges of the monitoring service (often SYSTEM/root on these appliances). Because the attack vector is network with low complexity and no user interaction, a single crafted authenticated request can compromise the host. No public exploit code is currently identified, and this is based on the vendor advisory only.