ManageEngine OpManager EUVD-2026-85272

Requires an authenticated low-privilege account on the OpManager MSP web console (PR:L) and access to the Notification Profile module, which is the specific feature carrying the OS command injection. No user interaction is needed and the vector is network-reachable. Exploitation is limited to affected versions 12.8.709 and below of the OpManager MSP edition specifically; the main limiting factor is the need for valid (even minimal) credentials, so risk is highest where operator or MSP-tenant accounts are broadly provisioned or where credentials can be phished/reused.

This is a genuinely high-priority issue on the signals that matter. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity flaw needing only low-privilege authentication and no user interaction, and CWE-78 (OS command injection) yields full-triad C:H/I:H/A:H remote code execution - Zoho's 9.9 is driven largely by the Scope-changed (S:C) claim. I lean toward S:U (which would score ~8.8), consistent with the sibling command-injection flaw CVE-2026-76978, because OS command injection typically executes as the service account without crossing a distinct security authority; verify S:C with the vendor. Against these strong intrinsic signals, the exposure signals are entirely absent: no EPSS probability score is provided, the CVE is NOT in CISA KEV, and no public POC is identified. So this is a real, patch-now vulnerability by impact and ease of exploitation, but there is no current evidence of active exploitation or automated mass-scanning - the low-privilege authentication requirement also gates it to actors who already hold a valid (even minimal) OpManager MSP account.

An attacker with low-privileged authenticated access to an OpManager MSP console (e.g. a limited operator account or a compromised MSP tenant credential) submits a crafted value through the Notification Profile module, injecting OS commands that the server executes with the privileges of the monitoring service. This yields remote code execution on the network-management host. No public exploit code is identified at time of analysis, but the low attack complexity makes weaponization straightforward once details are known.