ManageEngine OpManager EUVD-2026-85266

Requires a valid low-privilege authenticated session (PR:L) on ManageEngine OpManager or Firewall Analyzer version 12.8.709 or below, and access to the 'Rule Tracking Compare Policies' feature where attacker-controlled XML is parsed server-side. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) against the management console. Limiting factors: exploitation is gated behind having any console credential and reaching this specific feature, so it is not exploitable pre-authentication; impact is confined to confidentiality (data/file/resource disclosure) with no integrity or availability effect.

The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, with a scope change and high confidentiality impact - consistent with an XML Injection / XXE-style bug that lets a valid low-privilege console user read data outside the vulnerable component's authorization boundary (e.g. arbitrary file read or SSRF). No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a credible priority for organizations running these products because it is confidentiality-impacting and requires only a low-privilege account, but the PR:L barrier and single self-reported source (Zoho) place it below an internet-wide unauthenticated critical. The I:N/A:N metrics indicate no integrity or availability impact, so the practical concern is data/secret disclosure rather than takeover. Data gap to note: this is a single-source, vendor-self-reported advisory with no NVD enrichment, no EPSS, and no independent confirmation of affected build boundaries beyond '12.8.709 and below.'

An attacker who holds a low-privilege OpManager/Firewall Analyzer console account navigates to the Rule Tracking 'Compare Policies' feature and submits crafted XML containing an external entity or injected node. The parser processes the malicious XML server-side, causing the application to disclose sensitive file contents or internal resources (scope change, C:H) back to the attacker. No public exploit code is available and no active exploitation is reported, but the low complexity and low privilege requirement make weaponization by an authenticated insider or a phished/low-tier account realistic.