11
CVEs
2
Critical
4
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
1.0%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
4
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (30)
Zoho
443
Manageengine Opmanager
50
Manageengine Admanager Plus
47
Manageengine Adselfservice Plus
46
Manageengine Servicedesk Plus
45
Manageengine Adaudit Plus
45
Manageengine Applications Manager
38
Manageengine Desktop Central
34
Manageengine Supportcenter Plus
31
Manageengine Netflow Analyzer
28
Manageengine Assetexplorer
25
Manageengine Exchange Reporter Plus
25
Manageengine Servicedesk Plus Msp
25
Manageengine Password Manager Pro
22
Manageengine Eventlog Analyzer
17
Manageengine Pam360
16
Manageengine Network Configuration Manager
14
Manageengine Firewall Analyzer
12
Manageengine Remote Access Plus
11
Manageengine Access Manager Plus
10
Manageengine Log360
10
Manageengine Endpoint Central
10
Manageengine Oputils
8
Manageengine It360
8
Manageengine Datasecurity Plus
7
Manageengine Key Manager Plus
5
Servicedesk Plus
5
Manageengine Opmanager Msp
5
Manageengine Sharepoint Manager Plus
5
Manageengine Social It Plus
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-6516 | Remote code execution in Zohocorp ManageEngine ADAudit Plus (all builds before 8606) allows unauthenticated attackers to run arbitrary OS commands by abusing the product's agent API, which fails to sanitize input passed to a shell (CWE-78). Rated CVSS 10.0 by the vendor with a scope-changing vector, the flaw requires no privileges or user interaction and reaches the network-exposed agent communication channel directly. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity and unauthenticated nature make it a high-priority patch for any exposed deployment. | CRITICAL | 10.0 | 4.7% | 50 |
|
| CVE-2026-11374 | Account takeover in ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus is possible because SSO session-authentication tickets are generated with insufficient randomness and can be predicted by an unauthenticated remote attacker. Successful prediction lets the attacker impersonate arbitrary users and gain full session-level confidentiality, integrity, and availability impact (CVSS 9.0). No public exploit identified at time of analysis, but the issue is acknowledged in the vendor advisory. | CRITICAL | 9.0 | 1.2% | 46 |
|
| CVE-2026-11840 | Authenticated SQL injection in Zohocorp ManageEngine Password Manager Pro (before build 13232) and ManageEngine PAM360 (before build 8552) allows a network-authenticated attacker with low-level privileges to read, modify, or delete sensitive database contents. Given that Password Manager Pro is a privileged credential vault and PAM360 is a privileged access management platform, successful exploitation could expose every managed credential, secret, and privileged session record stored within the system. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the severity and target sensitivity make this a high-priority patching candidate. | HIGH | 8.8 | 1.6% | 46 |
|
| CVE-2026-14828 | Authenticated SQL injection across Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus enables any low-privilege authenticated user to query or manipulate the backend database. Because these products serve as enterprise privileged access management vaults - centralizing credentials for critical infrastructure - a successful injection attack could expose the entire stored credential set. Zohocorp has released fixed builds for all three products and no public exploit has been identified at time of analysis. | HIGH | 8.8 | 1.4% | 45 |
|
| CVE-2026-12263 | Authentication bypass in ManageEngine Password Manager Pro (all versions before 13232) and PAM360 (all versions before 8551) allows low-privileged network attackers to forge SAML assertions and gain unauthorized elevated access, including administrative sessions, within these enterprise credential vaults. The flaw stems from improper cryptographic signature verification of SAML responses (CWE-347), enabling token manipulation that the service provider cannot detect. Vendor patch is available; no public exploit code has been confirmed at time of analysis, but the crown-jewel nature of PAM platforms - storing all privileged enterprise credentials - makes this a high-priority remediation regardless of current exploitation status. | HIGH | 8.8 | 0.7% | 45 |
|
| CVE-2026-3183 | Multi-factor authentication bypass in Zohocorp ManageEngine ADSelfService Plus (all versions before build 6524) allows an actor holding valid first-factor credentials to circumvent the second authentication factor, per the vendor advisory CVE-2026-3183. The flaw (CWE-290, authentication bypass by spoofing) is network-reachable and low-complexity but requires low-level privileges (PR:L), and there is no public exploit identified at time of analysis. Because ADSelfService Plus governs self-service password reset and account management across Active Directory, a bypass here undermines a core identity-security control. | HIGH | 7.1 | 0.5% | 36 |
|
| CVE-2026-77697 | Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available. | MEDIUM | 6.3 | 0.2% | 32 |
|
| CVE-2026-85640 | Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis. | MEDIUM | 6.3 | 0.2% | 32 |
|
| CVE-2026-77698 | Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available. | MEDIUM | 5.7 | 0.2% | 29 |
|
| CVE-2026-77699 | Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed. | MEDIUM | 5.0 | 0.2% | 25 |
|
| CVE-2026-3182 | Cleartext transmission of sensitive information in Zohocorp ManageEngine Endpoint Central before version 11.4.2528.34 exposes mail configuration credentials to network interception. Authenticated users who trigger mail-related functionality cause the application to transmit sensitive data - likely SMTP credentials and server configuration - without encryption, making it capturable by any attacker with a network vantage point between the client and server. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS score of 4.3 (Medium) reflects the limited scope and authentication prerequisite. | MEDIUM | 4.3 | 0.3% | 22 |
|