ManageEngine Applications Manager EUVD-2026-85291

Requires an authenticated low-privileged user account on ManageEngine Applications Manager version 182000 or below (PR:L). The specific weakness is missing authorization enforcement on the proxy-settings configuration function, allowing a non-admin role to change a server-wide setting it should not control. No user interaction, no non-default configuration, and no special protocol are needed beyond network reachability to the management interface. The principal limiting factor is the prerequisite of valid low-privilege credentials - this is not remotely reachable pre-authentication.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 HIGH) indicates a network-reachable flaw exploitable by an already-authenticated low-privileged user with low complexity and no user interaction. There is NO EPSS score, NO CISA KEV listing, and NO public POC provided, so real-world exploitation is currently theoretical - no public exploit identified at time of analysis. The dual C:H/I:H rating is generous for a proxy-setting change: the actual mechanism (an authorization/scope gap letting a low-priv user alter proxy config so outbound monitoring traffic routes through an attacker-controlled proxy) yields strong confidentiality impact via credential/traffic interception (C:H is defensible), but I:H likely overstates integrity - active tampering/injection requires a fully positioned MitM, so I lean I:L for a realistic ~7.1. The assigned CWE-20 (Improper Input Validation) is a loose fit; the true weakness is broken authorization (a low-priv role performing an admin-scoped configuration change). Net: a genuine but authentication-gated risk, priority for patching in exposed ManageEngine deployments but not an emergency given no exploitation signals.

A low-privileged operator account (or an attacker who has phished/obtained such credentials) on a ManageEngine Applications Manager instance navigates to the proxy configuration and points outbound monitoring traffic at an attacker-controlled proxy. Subsequent monitoring polls to remote hosts, cloud APIs, or credentialed endpoints then flow through the attacker, exposing embedded credentials and monitored data. No public POC is available, but low attack complexity and no required user interaction make this trivial once low-priv access exists.