23
CVEs
2
Critical
7
High
0
KEV
0
PoC
1
Unpatched C/H
95.7%
Patch Rate
0.6%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
7
MEDIUM
14
LOW
0
Monthly CVE Trend
Affected Products (30)
Zoho
443
Manageengine Opmanager
50
Manageengine Admanager Plus
47
Manageengine Adselfservice Plus
46
Manageengine Servicedesk Plus
45
Manageengine Adaudit Plus
45
Manageengine Applications Manager
38
Manageengine Desktop Central
34
Manageengine Supportcenter Plus
31
Manageengine Netflow Analyzer
28
Manageengine Assetexplorer
25
Manageengine Exchange Reporter Plus
25
Manageengine Servicedesk Plus Msp
25
Manageengine Password Manager Pro
22
Manageengine Eventlog Analyzer
17
Manageengine Pam360
16
Manageengine Network Configuration Manager
14
Manageengine Firewall Analyzer
12
Manageengine Remote Access Plus
11
Manageengine Access Manager Plus
10
Manageengine Log360
10
Manageengine Endpoint Central
10
Manageengine Oputils
8
Manageengine It360
8
Manageengine Datasecurity Plus
7
Manageengine Key Manager Plus
5
Servicedesk Plus
5
Manageengine Opmanager Msp
5
Manageengine Sharepoint Manager Plus
5
Manageengine Social It Plus
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-6516 | Remote code execution in Zohocorp ManageEngine ADAudit Plus (all builds before 8606) allows unauthenticated attackers to run arbitrary OS commands by abusing the product's agent API, which fails to sanitize input passed to a shell (CWE-78). Rated CVSS 10.0 by the vendor with a scope-changing vector, the flaw requires no privileges or user interaction and reaches the network-exposed agent communication channel directly. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity and unauthenticated nature make it a high-priority patch for any exposed deployment. | CRITICAL | 10.0 | 4.7% | 50 |
|
| CVE-2026-11374 | Account takeover in ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus is possible because SSO session-authentication tickets are generated with insufficient randomness and can be predicted by an unauthenticated remote attacker. Successful prediction lets the attacker impersonate arbitrary users and gain full session-level confidentiality, integrity, and availability impact (CVSS 9.0). No public exploit identified at time of analysis, but the issue is acknowledged in the vendor advisory. | CRITICAL | 9.0 | 1.2% | 46 |
|
| CVE-2026-11840 | Authenticated SQL injection in Zohocorp ManageEngine Password Manager Pro (before build 13232) and ManageEngine PAM360 (before build 8552) allows a network-authenticated attacker with low-level privileges to read, modify, or delete sensitive database contents. Given that Password Manager Pro is a privileged credential vault and PAM360 is a privileged access management platform, successful exploitation could expose every managed credential, secret, and privileged session record stored within the system. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the severity and target sensitivity make this a high-priority patching candidate. | HIGH | 8.8 | 1.6% | 46 |
|
| CVE-2026-14828 | Authenticated SQL injection across Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus enables any low-privilege authenticated user to query or manipulate the backend database. Because these products serve as enterprise privileged access management vaults - centralizing credentials for critical infrastructure - a successful injection attack could expose the entire stored credential set. Zohocorp has released fixed builds for all three products and no public exploit has been identified at time of analysis. | HIGH | 8.8 | 1.4% | 45 |
|
| CVE-2026-12263 | Authentication bypass in ManageEngine Password Manager Pro (all versions before 13232) and PAM360 (all versions before 8551) allows low-privileged network attackers to forge SAML assertions and gain unauthorized elevated access, including administrative sessions, within these enterprise credential vaults. The flaw stems from improper cryptographic signature verification of SAML responses (CWE-347), enabling token manipulation that the service provider cannot detect. Vendor patch is available; no public exploit code has been confirmed at time of analysis, but the crown-jewel nature of PAM platforms - storing all privileged enterprise credentials - makes this a high-priority remediation regardless of current exploitation status. | HIGH | 8.8 | 0.7% | 45 |
|
| CVE-2026-2740 | Authenticated remote code execution affects Zoho ManageEngine ADSelfService Plus (before build 6525), DataSecurity Plus (before 6264), and RecoveryManager Plus (before 6313) on agent machines, stemming from a flaw in a bundled third-party dependency. An authenticated attacker with low privileges can inject commands (CWE-77) to execute arbitrary code on managed agent endpoints, with no public exploit identified at time of analysis. | HIGH | 8.4 | 1.2% | 43 |
|
| CVE-2026-3324 | Authentication bypass in Zohocorp ManageEngine Log360 (builds 13000 through 13013) lets remote unauthenticated attackers reach certain protected actions because of an improper request-filter configuration, exposing high-confidentiality data with limited integrity impact (CVSS 8.2). No public exploit is identified at time of analysis and EPSS is low (0.14%), but CISA's SSVC flags the flaw as automatable, so opportunistic scanning is plausible once details spread. Log360 is an enterprise SIEM/log-management console, making any auth bypass on it a high-value target for attackers seeking to blind defenders or harvest aggregated log data. | HIGH | 8.2 | 0.1% | 41 |
No patch
|
| CVE-2026-5785 | SQL injection in Zohocorp ManageEngine PAM360 (before build 8531) and Password Manager Pro (builds 8600 through 13230) lets an authenticated attacker inject arbitrary SQL through the query report module, enabling extraction and modification of privileged-vault data. Because these products are enterprise password/privileged-access managers, a successful injection can expose stored credentials and secrets for an entire environment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and a vendor patch is available. | HIGH | 8.1 | 0.0% | 41 |
|
| CVE-2026-3183 | Multi-factor authentication bypass in Zohocorp ManageEngine ADSelfService Plus (all versions before build 6524) allows an actor holding valid first-factor credentials to circumvent the second authentication factor, per the vendor advisory CVE-2026-3183. The flaw (CWE-290, authentication bypass by spoofing) is network-reachable and low-complexity but requires low-level privileges (PR:L), and there is no public exploit identified at time of analysis. Because ADSelfService Plus governs self-service password reset and account management across Active Directory, a bypass here undermines a core identity-security control. | HIGH | 7.1 | 0.5% | 36 |
|
| CVE-2026-77697 | Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available. | MEDIUM | 6.3 | 0.2% | 32 |
|
| CVE-2026-85640 | Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis. | MEDIUM | 6.3 | 0.2% | 32 |
|
| CVE-2026-77698 | Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available. | MEDIUM | 5.7 | 0.2% | 29 |
|
| CVE-2026-8174 | Cross-site request forgery in the Zoho Mail WordPress plugin (all versions before 1.6.2) enables a remote attacker to perform unauthorized, integrity-impacting actions on behalf of an authenticated WordPress user without their knowledge. The CVSS 5.7 medium score reflects high integrity impact with no confidentiality or availability exposure, requiring low-privilege victim authentication and user interaction. No public exploit code exists and no active exploitation has been identified; EPSS sits at the 1st percentile and SSVC classifies exploitation status as none. | MEDIUM | 5.7 | 0.0% | 29 |
|
| CVE-2026-4107 | Stored cross-site scripting in ManageEngine Exchange Reporter Plus before version 5802 allows authenticated attackers to inject malicious scripts via the Folder Message Count and Size report. With CVSS 7.3 (High severity) and requiring low-privilege authentication with user interaction, successful exploitation enables session hijacking and credential theft within the administrative interface. No public exploit identified at time of analysis, though CVSS vector indicates network-accessible attack surface with low complexity. | MEDIUM | 5.4 | 0.0% | 27 |
|
| CVE-2026-77699 | Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed. | MEDIUM | 5.0 | 0.2% | 25 |
|