EUVD-2026-85289
GHSA-4f59-c6wp-7cj6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryIdentify out-of-scope monitor and admin MBean action
-
ExploitSend request invoking action beyond assigned scope
-
ExecutionServer skips scope/permission validation
-
ImpactExecute privileged action on unauthorized monitor
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged Applications Manager account (PR:L) - exploitation is not possible unauthenticated. The attacker must target MBean actions that an administrator has already configured, and the affected instance must run version 182200 or below. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N), so any authenticated operator with restricted monitor scope can reach unauthorized monitors; the limiting factors are the need for valid credentials and the pre-existence of admin-configured MBean actions. |
| Impact | The vendor (Zoho) CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L (7.6, HIGH) is internally consistent and I agree with it: a low-privileged authenticated user (PR:L) can, over the network with low complexity, execute administrator-configured MBean actions against monitors outside their assigned scope - a broken-authorization/scope-enforcement flaw. Integrity impact is the dominant vector (I:H) because invoking privileged MBean actions can alter monitored systems or Applications Manager configuration, with lesser C:L/A:L side effects. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so despite the HIGH base score this is NOT a confirmed real-world priority - it reads as a moderate-priority patch-soon issue rather than an actively exploited one. One data caveat: the assigned CWE-306 (Missing Authentication for a Critical Function) does not match the description, which describes a low-priv user (i.e. an authenticated actor) bypassing scope/permission checks - this is an authorization/broken-access-control weakness (closer to CWE-862/CWE-863), not missing authentication. The 'Authentication Bypass' tag is likewise imprecise; the flaw is a privilege/scope escalation, not an auth bypass. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged Applications Manager account (e.g. an operator restricted to a subset of monitors) crafts a request to invoke an administrator-configured MBean action against a monitor outside their assigned scope. Because the server fails to validate that the target monitor belongs to the caller's scope, the action executes with effect on systems the user should not control. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Broken scope enforcement in ZohoCorp ManageEngine Applications Manager (versions 182200 and below) lets an authenticated, low-privileged user trigger administrator-configured MBean actions against monitors that lie outside that user's assigned scope, resulting in high integrity impact with limited confidentiality and availability effects (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, 7.6 HIGH). Exploitation requires a valid low-privileged Applications Manager account and the prior existence of administrator-configured MBean actions on the target instance; no user interaction is needed, and authentication requirements are confirmed as authenticated (PR:L) by the published vector. No public exploit code was identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis; the absence of a public exploit and the PR:L prerequisite are the main factors limiting immediate mass exploitation.
RemediationAI
Primary remediation is to upgrade ManageEngine Applications Manager to a build later than 182200; the vendor's advisory for this CVE (https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86681.html) documents the fixed release, so administrators should confirm the exact target build there before upgrading, since the provided data does not specify an exact patched version number. Until the upgrade is applied, compensate by removing or disabling non-essential administrator-configured MBean actions, because the vulnerability cannot be triggered without a pre-existing admin-configured action - the trade-off is loss of the monitoring/management automation those actions provide. Additionally, tighten account hygiene: audit and minimize the number of low-privileged operator accounts, revoke stale credentials, and verify that custom roles do not grant broader monitor scope than required, accepting that this reduces but does not eliminate exposure for legitimate operators who must retain access. Network-level controls should restrict reachability of the Applications Manager web console to trusted management subnets or VPN segments (side effect: remote operators lose direct access and must route through the trusted path), and enable and review audit logging for MBean action invocations and monitor-scope changes so that out-of-scope executions can be detected and the offending accounts disabled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ManageEngine Applications Manager is a Java-based infrastructure and application performance monitoring platform that uses JMX/MBean operations to collect metrics and run management actions against monitored resources. The vulnerability is a permissions-validation failure in the service that dispatches those administrator-defined MBean actions: the component fails to verify that the requesting operator's monitor scope actually includes the target monitor before executing the action. The published CWE is CWE-306 (Missing Authentication for Critical Function), reflecting that the critical action path lacks an adequate authorization/identity check at the point of execution, although the practical impact maps more closely to broken access control / scope-enforcement (a privilege-boundary failure) than to a fully unauthenticated entry point - the CVSS vector's PR:L confirms an account is required. The CPE cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:* indicates the flaw is version-scoped rather than tied to a specific deployment topology, and the network vector (AV:N) plus low attack complexity (AC:L) means any authenticated operator with a restricted monitor scope can potentially reach unauthorized monitors within the same deployment. Integrity impact is rated High because the attacker executes actions an administrator pre-authorized for other monitors, which can alter managed targets or monitoring state; confidentiality and availability are limited (C:L/A:L).
Know when Manageengine Applications Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Authenticated low-priv user over network (PR:L, AV:N, AC:L); executing privileged MBean actions on out-of-scope monitors is integrity-primary (I:H) with minor C:L/A:L.
Primary rating from Vendor (Zohocorp).
CVSS VectorVendor: Zohocorp
Lifecycle Timeline
2DescriptionCVE.org
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.
Executive ViewAI
ZohoCorp ManageEngine Applications Manager versions 182200 and below contain a high-severity scope enforcement flaw that allows authenticated low-privileged users to trigger administrator-configured MBean actions on monitors outside their assigned scope. This can lead to unauthorized configuration changes and data integrity compromise, affecting the reliability and trustworthiness of monitored systems. With no vendor patch currently available, organizations relying on this product should urgently assess exposure and implement compensating controls to prevent internal misuse.
No vendor-released patch identified at time of analysis; interim mitigations include restricting low-privileged account permissions, auditing and limiting administrator-configured MBean actions, enabling detailed logging and monitoring for scope violations, segmenting network access to the Applications Manager instance, and applying the vendor patch once available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). Rated
Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated
Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Rated cri
An issue was discovered in Zoho ManageEngine Applications Manager 11.0 through 14.0. Rated critical severity (CVSS 9.8),
A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids
A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_usernam
Zoho ManageEngine Applications Manager 13 before build 13500 allows Post-authentication SQL injection via the name param
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. Rated high severity (CVSS 8.8), this vuln
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. Rated high severity (CVSS 8.8), this vulnerability
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do widgetid parameter.
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /showresource.do resourceid pa
Zoho ManageEngine Applications Manager 13 before build 13530 allows SQL injection via the /MyPage.do?method=viewDashBoar
Exploit-DB