Manageengine Endpoint Central
Monthly
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Cleartext transmission of sensitive information in Zohocorp ManageEngine Endpoint Central before version 11.4.2528.34 exposes mail configuration credentials to network interception. Authenticated users who trigger mail-related functionality cause the application to transmit sensitive data - likely SMTP credentials and server configuration - without encryption, making it capturable by any attacker with a network vantage point between the client and server. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 4.3 (Medium) reflects the limited scope and authentication prerequisite.
ManageEngine Endpoint Central versions prior to 11.4.2528.05 log a sensitive agent token, allowing an authenticated user with access to the product's logs to recover that token. Exploitation requires a valid authenticated account and the ability to read or export logs (CVSS PR:L); no public exploit identified at time of analysis, and EPSS is 0.52% (low). This is a moderate-severity information disclosure issue (CVSS 4.3) fixed in 11.4.2528.05.
XML injection in Zoho ManageEngine EndPoint Central versions 11.4.2516.1 and prior allows an authenticated attacker with local access to inject malicious XML content, leading to low-level impacts on confidentiality, integrity, and availability. The vulnerability requires a low-privileged account and local access (CVSS vector AV:L/PR:L), and there is no public exploit identified at time of analysis. EPSS score is 0.34% (25th percentile), indicating low real-world exploitation likelihood, and no CISA KEV status is present.
Local privilege escalation in Zoho ManageEngine Endpoint Central is possible through an arbitrary file deletion flaw in the agent setup component, letting an attacker who already holds a low-privileged local foothold delete files of their choosing - including files that the higher-privileged agent service depends on - on hosts running agent builds earlier than 11.4.2508.14, 11.4.2516.06, or 11.4.2518.01. The attack is strictly local (CVSS AV:L) and requires an authenticated low-privilege account (PR:L) with no victim interaction (UI:N), which caps both severity and reachability; there is no public exploit code identified at time of analysis and the issue is not in CISA KEV, making this a low-priority finding that is nonetheless worth patching during routine agent maintenance.
Improper privilege management in the Zoho ManageEngine Endpoint Central agent setup allows an authenticated local attacker holding only low privileges on a managed endpoint to escalate to full system-level control, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, HIGH). Affected builds are Endpoint Central through 11.4.2500.25 and through 11.4.2508.13, and exposure is limited to endpoints where the Endpoint Central agent is actually installed and running; servers hosting only the management console without a local agent are not reachable through this vector. Exploitation cannot be initiated remotely or by an unauthenticated actor - it requires a pre-existing local foothold (AV:L, PR:L, UI:N) - and there is no public exploit identified at time of analysis, with EPSS at 0.01% (1st percentile), indicating very low predicted exploitation activity in the near term.
ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.3.2406.08 and before 11.3.2400.15. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available.
Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed.
Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available.
Cleartext transmission of sensitive information in Zohocorp ManageEngine Endpoint Central before version 11.4.2528.34 exposes mail configuration credentials to network interception. Authenticated users who trigger mail-related functionality cause the application to transmit sensitive data - likely SMTP credentials and server configuration - without encryption, making it capturable by any attacker with a network vantage point between the client and server. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 4.3 (Medium) reflects the limited scope and authentication prerequisite.
ManageEngine Endpoint Central versions prior to 11.4.2528.05 log a sensitive agent token, allowing an authenticated user with access to the product's logs to recover that token. Exploitation requires a valid authenticated account and the ability to read or export logs (CVSS PR:L); no public exploit identified at time of analysis, and EPSS is 0.52% (low). This is a moderate-severity information disclosure issue (CVSS 4.3) fixed in 11.4.2528.05.
XML injection in Zoho ManageEngine EndPoint Central versions 11.4.2516.1 and prior allows an authenticated attacker with local access to inject malicious XML content, leading to low-level impacts on confidentiality, integrity, and availability. The vulnerability requires a low-privileged account and local access (CVSS vector AV:L/PR:L), and there is no public exploit identified at time of analysis. EPSS score is 0.34% (25th percentile), indicating low real-world exploitation likelihood, and no CISA KEV status is present.
Local privilege escalation in Zoho ManageEngine Endpoint Central is possible through an arbitrary file deletion flaw in the agent setup component, letting an attacker who already holds a low-privileged local foothold delete files of their choosing - including files that the higher-privileged agent service depends on - on hosts running agent builds earlier than 11.4.2508.14, 11.4.2516.06, or 11.4.2518.01. The attack is strictly local (CVSS AV:L) and requires an authenticated low-privilege account (PR:L) with no victim interaction (UI:N), which caps both severity and reachability; there is no public exploit code identified at time of analysis and the issue is not in CISA KEV, making this a low-priority finding that is nonetheless worth patching during routine agent maintenance.
Improper privilege management in the Zoho ManageEngine Endpoint Central agent setup allows an authenticated local attacker holding only low privileges on a managed endpoint to escalate to full system-level control, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, HIGH). Affected builds are Endpoint Central through 11.4.2500.25 and through 11.4.2508.13, and exposure is limited to endpoints where the Endpoint Central agent is actually installed and running; servers hosting only the management console without a local agent are not reachable through this vector. Exploitation cannot be initiated remotely or by an unauthenticated actor - it requires a pre-existing local foothold (AV:L, PR:L, UI:N) - and there is no public exploit identified at time of analysis, with EPSS at 0.01% (1st percentile), indicating very low predicted exploitation activity in the near term.
ManageEngine Endpoint Central versions before 11.3.2440.09 are vulnerable to IDOR vulnerability which allows the attacker to change the username in the chat. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability while isolating the devices.3.2406.08 and before 11.3.2400.15. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.