ManageEngine ADSelfService Plus EUVD-2026-31283

Exploitation requires an authenticated session on the ManageEngine product (PR:L) with sufficient rights to invoke functionality that reaches the vulnerable third-party dependency code path on an agent machine, plus network reachability from the attacker to the management server (AV:N). Limiting factors are significant: the high attack complexity (AC:H) indicates a non-trivial condition such as specific input shaping, timing, or a particular agent state must be met for the command injection to succeed; the target organization must have deployed agents (the bug is on agent machines, not the standalone console); and only ADSelfService Plus before 6525, DataSecurity Plus before 6264, and RecoveryManager Plus before 6313 are vulnerable. No user interaction is required (UI:N).

The CVSS 3.1 base score of 8.4 (vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) reflects a network-reachable issue requiring low privileges and no user interaction, with high attack complexity and a changed scope, meaning successful exploitation on the agent crosses a trust boundary back into managed assets. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and EPSS data is not provided, so real-world exploitation pressure is presently low. However, the combination of authenticated RCE on agent endpoints in an identity/AD-recovery product family makes this a high-value target for post-foothold lateral movement, particularly because ManageEngine products have a documented history of being weaponized by APT and ransomware operators after disclosure. AC:H tempers urgency relative to CVSS, since exploitation depends on the specific third-party dependency code path and likely non-trivial conditions; treat this as a high-priority patch rather than an emergency.

An attacker who has obtained low-privileged credentials to the ManageEngine console (for example via phishing of a helpdesk operator or credential reuse) leverages an authenticated workflow that interacts with the vulnerable third-party dependency on a deployed agent. By crafting input containing shell metacharacters, the attacker triggers command injection on the agent host and executes arbitrary code in the agent's process context, pivoting from a single console foothold to arbitrary endpoints across the managed estate. No public exploit code has been identified at time of analysis.