ManageEngine Applications Manager EUVD-2026-85295

Requires valid low-privileged authenticated access to a ManageEngine Applications Manager instance (version 182000 or below); network reachability to the web application; no user interaction and no special non-default configuration are indicated. The primary limiting factor is the need for low-privileged credentials (PR:L) - the flaw is not exploitable by a fully anonymous attacker per the CVSS vector. Any authenticated account, however, is sufficient, and attack complexity is low (AC:L), so credential access is the only meaningful barrier.

This is a genuine high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity SQL injection (CWE-89) exploitable by any low-privileged authenticated user, yielding full confidentiality, integrity, and availability impact. The description escalates this further: SQLi 'potentially gaining administrator access and remote code execution', which is consistent with the RCE tag and the C:H/I:H/A:H rating. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or imminent widespread exploitation - this is a vendor (Zoho) self-reported advisory rather than an in-the-wild finding. The signals are therefore consistent and non-conflicting: high technical severity but currently no confirmed exploitation. The single limiting factor is the PR:L requirement - an attacker needs valid low-privileged credentials, which tempers mass-exploitation risk relative to a fully unauthenticated flaw. Priority should be high for organizations running exposed or multi-user Applications Manager instances, driven by impact and low complexity rather than by any observed exploitation.

An attacker who holds or obtains low-privileged credentials on a ManageEngine Applications Manager instance submits crafted input into a vulnerable parameter that is concatenated into a backend SQL query. By injecting SQL, they read or modify database records to elevate to administrator, and chain that access to achieve remote code execution on the server. No public exploit code is identified at the time of analysis.