ManageEngine Applications Manager CVE-2026-86679

Requires an authenticated low-privileged Applications Manager account (PR:L) with network reachability to the console/API; no user interaction is needed. Exploitation targets the service-monitor delete function, where scope/permission validation is missing, allowing deletion of monitors outside the caller's assigned scope. Limiting factors: valid credentials are mandatory (not unauthenticated), and impact is bounded to monitoring configuration integrity and partial availability of monitoring coverage rather than the monitored systems themselves. Affects versions 182000 and below.

CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) frames this as a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, with high integrity impact and partial availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so no evidence of active or automated exploitation exists. The realistic risk is moderate and insider/tenant-scoped rather than mass-exploitable: the attacker must already hold a valid low-privileged Applications Manager account, which sharply limits the attacker population versus an unauthenticated flaw. The primary signal conflict is the CWE and tag metadata: CWE-20 (Improper Input Validation) is a poor fit for what the description plainly states is a broken permissions/scope-enforcement bug (properly CWE-862/CWE-863), and the 'Information Disclosure' tag is contradicted by the vector itself (C:N, I:H) - this is a destructive integrity/availability issue, not disclosure. Vendor self-reporting (Zoho) means the vector is unverified by a third party. Treat as a real but authenticated, targeted-abuse priority (monitoring tampering) rather than a high-CVSS internet-facing emergency.

A low-privileged Applications Manager user (or an attacker who has phished/compromised such an account) issues a monitor-delete request targeting service monitors that belong to teams or scopes outside their own assignment. Because scope/permission validation is not enforced on the delete action, the request succeeds, wiping monitoring coverage for critical services. No public proof-of-concept is available, but the low attack complexity means a valid account holder could trigger it with a single crafted API/UI request.