ManageEngine Endpoint Central EUVD-2026-46154

Exploitation requires the attacker to hold at least low-privilege authenticated access to the ManageEngine Endpoint Central web console (PR:L per CVSS vector). The attacker must also occupy a network position capable of intercepting traffic between the Endpoint Central server and the endpoint or mail relay - such as the same LAN, a compromised network switch, or an ARP-poisoning scenario. The mail configuration feature must be active and accessible to the authenticated user's role. No special non-default configuration is required beyond having mail settings configured in the product, which is common in enterprise deployments. What limits exploitation: the PR:L requirement filters out fully external unauthenticated attackers, and passive interception requires network adjacency or a pre-existing foothold on the network path.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) accurately reflects a constrained but real risk: low privileges are required, and impact is limited to partial confidentiality loss with no integrity or availability consequence. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. KEV status is negative and no POC has been disclosed, indicating this is not currently under active or opportunistic exploitation. The realistic threat actor is a network-adjacent insider or an attacker already holding a foothold on the same network segment who can passively capture traffic. The primary value of exploiting this flaw is credential harvesting - SMTP credentials from an endpoint management platform could be leveraged for phishing infrastructure or lateral movement into mail systems, elevating real-world impact beyond the raw CVSS score suggests. The authentication requirement (PR:L) meaningfully limits the exposed population to users with at least low-level access to the product.

An authenticated attacker - such as a low-privileged help desk user with access to the ManageEngine console - triggers the mail configuration feature while a network monitoring tool captures traffic on the same LAN or VLAN segment. The SMTP server address, port, and credentials are transmitted in cleartext and captured, allowing the attacker to authenticate directly to the mail relay or use the credentials in credential-stuffing campaigns. No public exploit code is required; standard packet capture tools (e.g., Wireshark, tcpdump) are sufficient.