ManageEngine Endpoint Central CVE-2026-77698

Exploitation requires: (1) local interactive or terminal access to an endpoint running the ManageEngine Endpoint Central agent at a version prior to 11.5.2605.01; (2) at minimum a low-privileged local OS account (PR:L in CVSS) sufficient to write to a path exercised during the agent upgrade; and (3) a higher-privileged process or user must trigger the agent upgrade sequence (UI:R), such as an administrator pushing updates through the Endpoint Central console or a scheduled upgrade task. The attack is strictly local (AV:L) and cannot be initiated remotely without prior foothold. Systems not enrolled in Endpoint Central are unaffected. The low attack complexity (AC:L) indicates no special timing or race conditions are required once the attacker has positioned their payload.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 5.7) frames this as a locally exploitable, low-complexity escalation requiring low initial privileges and user interaction - the UI:R element likely reflects a requirement for an administrator or automated service to trigger the upgrade sequence. The scope change (S:C) is the most operationally significant signal: exploitation elevates the attacker beyond their initial privilege boundary into a higher-privileged context, a prerequisite for lateral movement or persistence on managed endpoints. The C:L/I:L/A:L impact metrics suggest the escalation reaches an intermediate privilege level rather than full SYSTEM access, though this is not independently confirmed from public sources. No EPSS score was provided in the input data. Absent KEV listing or public PoC, immediate mass exploitation is unlikely; however, endpoint management agents are installed on every managed workstation, meaning a single exploitable endpoint is representative of the entire fleet - even a mid-sized municipal IT team in mielec managing several hundred endpoints faces the same systemic exposure as a large enterprise. CVSS vector is internally consistent with the description; no conflict detected.

A low-privileged local user on a managed endpoint identifies a directory traversed by the Endpoint Central agent upgrade process that is writable by their account, then places a malicious binary or DLL in that path. When the agent upgrade is subsequently triggered - either by an administrator manually initiating an update or by a scheduled upgrade task running under a higher-privileged service account - the malicious payload executes with elevated privileges, granting the attacker capabilities beyond their original access level. No public proof-of-concept has been identified at time of analysis.