Malware Protection Plus EUVD-2026-98324

Requires an attacker who already holds high privileges (PR:H, i.e. administrative rights) on the endpoint running ManageEngine Malware Protection Plus, and per the vendor vector also local/physical access to the machine (AV:P) - this is not remotely or network exploitable. The specific prerequisite is the ability to invoke the MEARWService component and supply a driver; the service's failure to enforce valid driver signatures is the enabling condition. Limiting factors that reduce real-world risk: no user interaction of a victim is needed (UI:N) but the attacker must first achieve admin-level and physical presence, and only versions before 1.0.64.12 are affected (patched in 1.0.64.12).

This is a low-to-moderate real-world priority despite being a kernel-adjacent driver flaw. The vendor CVSS of 4.9 (MEDIUM) is driven down by two strong mitigating metrics in the supplied vector (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H): a Physical attack vector (AV:P) and High privileges required (PR:H), meaning an attacker must already hold elevated access to the host. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. CONFLICT TO VERIFY: the vendor vector sets C:N/I:N and reports only availability impact (A:H), yet the root cause - insufficient driver signature validation in MEARWService - would normally let an attacker load an unsigned/malicious kernel driver, which typically yields full confidentiality and integrity compromise, not just availability loss; the impact metrics appear understated. Additionally, AV:P (physical) is unusual for a driver-loading service flaw that is normally a local/software operation (AV:L) - verify the true attack vector with Zohocorp. Net: not an urgent patch-now item on raw signals, but the pre-conditions (attacker already has admin/physical access) and the kernel-driver nature mean it should be patched in normal cycles because successful exploitation gives kernel-level foothold.

An attacker who has already gained high-privilege (administrative) access to a workstation or server running ManageEngine Malware Protection Plus abuses the MEARWService component, which fails to properly validate driver signatures, to load an improperly signed or malicious kernel-mode driver. Because the CVSS scope is Changed (S:C), the loaded driver executes at kernel level and can impact the integrity of the protected system beyond the vulnerable service itself. No public exploit code was identified in the provided intelligence, and exploitation requires pre-existing privileged (and per the vendor vector, physical) access.