ManageEngine Firewall Analyzer CVE-2026-76980

Exploitation requires network adjacency (AV:A) to a deployment of ManageEngine OpManager or Firewall Analyzer version 12.8.709 or below, with the Firewall Analyzer syslog collector component active and reachable - the attacker must be on the same network segment able to communicate with the syslog collector service. No authentication (PR:N) and no user interaction (UI:N) are needed against a default configuration, and complexity is low (AC:L). The primary limiting factor is the adjacent-network requirement: the collector is not exploitable directly from the internet unless the syslog service is exposed beyond the local segment, which meaningfully narrows the attacker population to those with existing LAN access.

The vendor-assigned CVSS 3.1 score of 7.4 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) marks this as a HIGH-severity, unauthenticated confidentiality breach reachable from the adjacent network, with a scope change reflecting that the syslog collector leaks data belonging to monitored firewall/network devices rather than only the collector itself. However, real-world urgency signals are limited: there is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis - this is a Zoho self-reported advisory with a single vendor reference. The exploitation status is therefore 'no public exploit identified at time of analysis.' The AV:A (adjacent) vector is a meaningful limiter versus a fully remote (AV:N) flaw: an attacker must sit on the same network segment as the syslog collector, consistent with syslog's typical UDP/514 broadcast/LAN nature. Net assessment: a genuinely elevated confidentiality risk in security-monitoring infrastructure (which handles sensitive firewall/log data), but not an emergency-patch scenario absent any exploitation evidence - prioritize as a high-value internal-network exposure to remediate on a normal-but-prompt cycle. Note: the description ('Data Exposure') and CWE-20 (Improper Input Validation) are somewhat mismatched - the impact is disclosure while the root cause label suggests malformed-input handling; verify the exact leak mechanism with the vendor advisory.

An attacker with a foothold on the same network segment as a ManageEngine OpManager or Firewall Analyzer deployment interacts with the Firewall Analyzer syslog collector service and, without authentication, causes it to expose sensitive log/monitoring data it should not return. Because the vector is adjacent (AV:A) and low-complexity (AC:L) with no user interaction, exploitation is straightforward for anyone already on the LAN, though no public proof-of-concept currently exists.