ManageEngine OpManager EUVD-2026-85260

Requires a valid low-privilege authenticated account (PR:L) on ManageEngine OpManager or Firewall Analyzer at version 12.8.710 or below; the attacker must reference Change Management report-schedule configurations for firewalls outside their own assigned scope. No user interaction is needed and the vector is network-based over the product's web interface. Exploitation is limited by the need for pre-existing account access and by deployments that actually segment firewalls across scopes/tenants - a single-scope or single-admin install has little to steal cross-scope.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N = 7.1) describes a network-reachable, low-complexity flaw requiring only a low-privilege authenticated account and no user interaction - a plausible insider or post-compromise escalation path in multi-tenant/RBAC deployments of ManageEngine OpManager and Firewall Analyzer. Exploitation status is 'no public exploit identified at time of analysis': there is no CISA KEV listing, no POC reference (the only reference is the vendor advisory), and EPSS is not provided, so exploitation probability cannot be quantified. The one signal that looks inflated is C:H: the description states only that a low-privilege user can 'modify Change Management report schedule configurations for firewalls outside their assigned scope,' which is fundamentally an integrity/authorization defect (CWE-639 IDOR), not a bulk data-disclosure primitive - C:H is defensible only if altering the schedule causes out-of-scope firewall change-management reports to be delivered to the attacker (indirect disclosure). Absent active-exploitation or POC signals, this is a moderate-priority patch: real (broken tenant/scope isolation in a security appliance) but not an emergency, and best prioritized where OpManager/Firewall Analyzer is exposed to many low-trust users.

A low-privilege authenticated user of ManageEngine OpManager or Firewall Analyzer sends a crafted request to the Change Management report-schedule endpoint referencing a firewall ID outside their assigned scope, and the server applies the change without an ownership/scope check. The attacker can thereby reconfigure or redirect scheduled change-management reporting for firewalls they should not administer. No public exploit code is identified at time of analysis; exploitation requires a valid low-privilege account.