ManageEngine OpManager CVE-2026-84787

Requires a valid authenticated low-privilege user account on ManageEngine OpManager or Firewall Analyzer (version 12.8.710 or below) with access to the Report Profile import functionality; escalation is triggered by importing a crafted report profile. Limiting factors: the attacker must already possess working low-privilege credentials (PR:L) and the instance must be reachable over the network - but no user interaction and no non-default configuration are needed, and any authenticated user tier suffices.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High) describes a low-complexity, network-reachable privilege escalation requiring only a valid low-privileged account (PR:L) and no user interaction. The impact is severe: escalation to full Administrator yields high confidentiality and integrity loss over the management platform, which typically holds credentials and network topology for the environments it monitors. However, real-world exploitation signals are weak-to-absent: no EPSS score, no CISA KEV listing, and no publicly identified exploit code, so this is currently a high-CVSS issue without evidence of active exploitation. The CWE-250 (execution with unnecessary privileges) classification is consistent with a report-import feature performing privileged operations. Note the vendor rated A:N (no availability impact) even though an attacker who becomes Administrator could plausibly disrupt the service - treat A:N as the vendor's scoping choice, not a proven ceiling. Priority is moderate-to-high for organizations running these products because the barrier (any authenticated low-priv user) is low, but the lack of exploitation telemetry argues for patch-in-cycle rather than emergency response absent other indicators.

An attacker with a valid low-privileged ManageEngine OpManager or Firewall Analyzer account (e.g., a read-only operator or an account obtained via credential reuse) logs in and abuses the Report Profile import function, which processes imported profile data with excessive privileges. The crafted import elevates the attacker's session to Administrator, granting full control of the monitoring platform. No public exploit code has been identified at time of analysis.