ManageEngine Endpoint Central EUVD-2026-72340

The attacker requires a local account with low privileges (PR:L) on the host where ManageEngine Endpoint Central is installed and its service is running. The service must perform JAR extraction in a context the low-privileged user can influence - either by placing a crafted JAR in a monitored input directory, or by leveraging any Endpoint Central function that accepts or processes JAR files from user-accessible paths. No special non-default configuration is documented as required beyond basic product installation. Exploitation is limited to hosts with Endpoint Central installed; remote-only attackers without local account access cannot exploit this flaw. The AV:L vector confirms this is strictly a local privilege escalation scenario.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L scores 6.3 (Medium), reflecting a local, low-complexity, low-privilege attack that escapes its scope to affect the broader system. The Scope:Changed metric is the most consequential element - it signals that exploitation allows the attacker to influence components beyond the user context, consistent with privilege escalation to the service account or OS level. The C:L/I:L/A:L impacts are conservative; the actual achievable impact upon successful file placement in a privileged directory could be significantly higher (e.g., arbitrary code execution as SYSTEM via DLL planting), depending on exact extraction paths and service configuration. No KEV listing and no POC availability have been identified, but the vulnerability is in a well-known enterprise product reported directly by the vendor, suggesting genuine internal discovery. The combination of low attack complexity, no user interaction, and S:C makes this a meaningful local escalation risk despite the medium base score.

A low-privileged local user on a Windows host running ManageEngine Endpoint Central crafts a JAR file containing path traversal entries (e.g., entries resolving to '../../Windows/System32/') and places or triggers it in a location processed by the Endpoint Central service. When the service extracts the archive under its elevated privilege context, the crafted paths cause malicious files - such as a rogue DLL - to be written to system directories, enabling the attacker to achieve code execution or persistent access at the service account privilege level. No public proof-of-concept code has been identified at time of analysis.