EUVD-2026-72340
GHSA-cqf9-3872-r742
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Local low-privilege attacker influences JAR extraction by an elevated-context service; scope change (S:C) is warranted; conservative C/I/A:L per vendor's own characterization.
Primary rating from Vendor (Zohocorp).
CVSS VectorVendor: Zohocorp
Lifecycle Timeline
3DescriptionCVE.org
Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction
AnalysisAI
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker requires a local account with low privileges (PR:L) on the host where ManageEngine Endpoint Central is installed and its service is running. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L scores 6.3 (Medium), reflecting a local, low-complexity, low-privilege attack that escapes its scope to affect the broader system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ManageEngine Endpoint Central to version 11.4.2540.23 or later as directed by the vendor advisory at https://www.manageengine.com/products/desktop-central/kb/vulnerability-management/privilege-escalation-vulnerability-during-jar-extraction.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today