ManageEngine Endpoint Central EUVD-2026-72337

Exploitation requires: (1) local access to the target Windows host running ManageEngine Endpoint Central below version 11.5.2605.01; (2) low-privilege user account on that host (PR:L confirmed by CVSS vector); (3) write access to at least one directory searched by the vulnerable process before the legitimate DLL path - typically the application directory, current working directory, or a user-writable temp/path location; and (4) a triggering action that causes Endpoint Central to load the DLL (UI:R per CVSS vector, implying an authorized user or scheduled process must invoke the vulnerable code path). The high attack complexity (AC:H) reflects the requirement to successfully pre-position the DLL in the correct search path before the application loads it. Exploitation is constrained to hosts where Endpoint Central is installed and to scenarios where the attacker already has local authenticated access - remote unauthenticated exploitation is not possible given AV:L.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L scores 5.0 (Medium), and the constituent metrics accurately reflect meaningful mitigating conditions: local physical or remote shell access is a prerequisite, the attack complexity is high (attacker must successfully pre-position a DLL in a specific writable path ahead of the application's load), user interaction is required to trigger the vulnerable code path, and the direct impact per C/I/A is limited. The scope change (S:C) signals the malicious DLL executes in a context beyond the initiating low-privilege user - likely a higher-privileged service account or SYSTEM - which partially offsets the limited per-category impact scores. No EPSS data was provided in the input; no KEV listing exists; no public exploit code has been identified, suggesting this is not currently being exploited at scale. However, ManageEngine Endpoint Central is a deeply privileged IT management agent deployed broadly across enterprise Windows endpoints; privilege escalation on an endpoint management agent is strategically high-value for an insider threat or a post-exploitation adversary who has gained initial foothold. Real-world risk is meaningfully higher than the CVSS score implies for any environment where untrusted local users can write to relevant directories - patching is advisable as a routine update cycle item.

A low-privileged local user (e.g., a standard domain user or helpdesk operator) with write access to a directory in Endpoint Central's DLL search path plants a malicious DLL named to match a library the application attempts to load. When an authorized user or a scheduled task triggers the vulnerable code path - causing the application to search for the DLL - the malicious library is loaded into the higher-privileged Endpoint Central process context, executing attacker-controlled code with elevated privileges. No public POC code was identified at time of analysis, but the DLL hijacking technique is well-understood and widely documented.