ManageEngine Endpoint Central EUVD-2026-72338

Exploitation requires an authenticated local account with low (non-administrative) privileges on the host system running ManageEngine Endpoint Central - confirmed by the CVSS vector PR:L and AV:L. The attacker must have the ability to execute code locally on the Endpoint Central server; purely remote exploitation without a prior foothold is not possible. All installations of ManageEngine Endpoint Central below version 11.5.2600.15 are vulnerable regardless of specific configuration. No non-default configuration setting is required to be exposed - the vulnerable outdated component is present in all affected installations by default. The key limiting factors are the requirement for existing local system access and the absence of any network-facing attack path.

The CVSS 6.3 score (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) captures a locally exploitable, low-complexity flaw that requires an existing low-privilege account on the host. The local attack vector is the dominant limiting factor - remote exploitation without a prior foothold is not possible, substantially reducing exposure compared to network-accessible vulnerabilities. The scope change (S:C) is the most strategically significant element: Endpoint Central's role as a management hub means an attacker who escalates privileges on this server can potentially pivot to all managed endpoints, amplifying the downstream blast radius well beyond what the C:L/I:L/A:L direct impact values suggest. No EPSS score was provided in the input data, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. POC availability is unknown. Even a mid-sized municipal IT team in walbrzych running Endpoint Central to manage hundreds of devices should treat this as a meaningful patching priority, precisely because the server's management reach transforms a moderate local privilege escalation into a potential stepping stone for broader lateral movement. The absence of public exploit code and KEV listing reduces urgency relative to remotely exploitable critical flaws, but the platform's architectural sensitivity elevates real-world risk above the raw score implies.

An attacker who has obtained a low-privilege local account on the Endpoint Central management server - through credential theft, an unrelated vulnerability, or insider access - interacts with the outdated bundled component to trigger improper privilege handling and escalate to a higher-privilege context. From that elevated position on the management server, the attacker can leverage Endpoint Central's native endpoint management capabilities to deploy malicious software or execute commands across all managed devices in the fleet. No public exploit code exists, but the vulnerability class (outdated component with known CWE-269 behavior) is well-understood by attackers.