ManageEngine OpManager EUVD-2026-85261

Requires an authenticated low-privilege user account on ManageEngine OpManager or Firewall Analyzer version 12.8.710 or below (PR:L, no user interaction). Exploitation is only meaningful in deployments that use scoped/segmented access - i.e., multiple users, teams, or tenants with firewalls assigned to distinct scopes; in a flat single-admin deployment there is no boundary to cross. The limiting factors are the need for valid (even minimal) console credentials and a multi-scope configuration; there is no unauthenticated or default-config network exploitation path.

This is a vendor-reported (ZohoCorp) authorization flaw with no corroborating exploitation signals: no EPSS score, no CISA KEV listing, and no public POC were provided - so this is 'no public exploit identified at time of analysis'. The vendor CVSS of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) is network-reachable and low-complexity but explicitly requires an authenticated low-privilege account (PR:L), which materially constrains the attacker population to insiders or those who have already obtained valid credentials. The C:H rating appears inflated for the described behavior: the flaw lets a low-privilege user 'create alert notifications for firewalls outside their assigned scope', which is fundamentally a cross-tenant/cross-scope integrity and boundary-violation issue (CWE-639 IDOR), not a bulk data-disclosure primitive - so a High confidentiality impact is questionable and should be verified against the vendor advisory. Net: this is a moderate, authenticated broken-access-control bug relevant to multi-tenant/segregated OpManager and Firewall Analyzer deployments, not a high-urgency unauthenticated RCE; real-world priority is low-to-medium absent any exploitation evidence.

A low-privilege user (or an attacker who has phished/stolen such an account) logs into the ManageEngine OpManager or Firewall Analyzer web console and issues requests to create alert-notification rules referencing firewall objects assigned to other users, teams, or tenants. Because the server does not enforce scope ownership on the target object, the notifications are created outside the attacker's authorized boundary, enabling cross-scope reconnaissance or misuse of monitoring/alerting. No public exploit code was identified at time of analysis.