EUVD-2026-85228
GHSA-rxm6-4vc4-h8j2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Network-reachable, low-complexity SSTI needing only low-privilege auth (PR:L) and no interaction; server-side template injection yields full RCE, so C/I/A all High.
Primary rating from Vendor (Zohocorp).
CVSS VectorVendor: Zohocorp
Lifecycle Timeline
3DescriptionCVE.org
ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.
AnalysisAI
Server-side template injection in the Configlet processing feature of ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager (versions 12.8.667 and below) allows a low-privileged authenticated user to inject template expressions that the server evaluates, leading to remote code execution in the application's process context. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; the source data lists 7.6) confirms network reachability, low privileges, and no victim interaction, but valid application credentials plus access to the Configlet/template capability are prerequisites, so real-world exposure is reduced where the console is network-restricted or where accounts lack configuration-template rights. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged authenticated account (PR:L) on the target and the ability to reach the Configlet processing feature - a configuration-template capability associated with Network Configuration Manager functionality that is also present in the bundled OpManager and NetFlow Analyzer builds. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine mid-to-upper priority issue but not an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade each affected product - OpManager, NetFlow Analyzer, and Network Configuration Manager - above the 12.8.667 baseline; the vendor's advisory at https://www.manageengine.com/itom/advisory/cve-2026-12370.html is the authoritative source for the exact fixed build, since a specific patched version number is not confirmed in the available data (patch availability is referenced by the advisory only, and no exact fix version should be assumed here). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every instance of ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager and confirm which are running 12.8.667 or earlier; immediately restrict network reachability of those consoles to trusted management segments or VPN only, and review which accounts hold Configlet or template-editing privileges, revoking them from anyone who does not strictly require them. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Share
External POC / Exploit Code
Leaving vuln.today