5
CVEs
0
Critical
1
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (30)
Zoho
443
Manageengine Opmanager
50
Manageengine Admanager Plus
47
Manageengine Adselfservice Plus
46
Manageengine Servicedesk Plus
45
Manageengine Adaudit Plus
45
Manageengine Applications Manager
38
Manageengine Desktop Central
34
Manageengine Supportcenter Plus
31
Manageengine Netflow Analyzer
28
Manageengine Assetexplorer
25
Manageengine Exchange Reporter Plus
25
Manageengine Servicedesk Plus Msp
25
Manageengine Password Manager Pro
22
Manageengine Eventlog Analyzer
17
Manageengine Pam360
16
Manageengine Network Configuration Manager
14
Manageengine Firewall Analyzer
12
Manageengine Remote Access Plus
11
Manageengine Access Manager Plus
10
Manageengine Log360
10
Manageengine Endpoint Central
10
Manageengine Oputils
8
Manageengine It360
8
Manageengine Datasecurity Plus
7
Manageengine Key Manager Plus
5
Servicedesk Plus
5
Manageengine Opmanager Msp
5
Manageengine Sharepoint Manager Plus
5
Manageengine Social It Plus
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-14828 | Authenticated SQL injection across Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus enables any low-privilege authenticated user to query or manipulate the backend database. Because these products serve as enterprise privileged access management vaults - centralizing credentials for critical infrastructure - a successful injection attack could expose the entire stored credential set. Zohocorp has released fixed builds for all three products and no public exploit has been identified at time of analysis. | HIGH | 8.8 | 1.4% | 45 |
|
| CVE-2026-77697 | Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.4.2540.23 allows a local low-privileged user to gain elevated access via a path-traversal or symlink-following flaw during JAR archive extraction. The Endpoint Central service, which typically runs under a high-privileged system account, unsafely extracts attacker-influenced JAR contents, permitting file writes outside the intended extraction directory and into privileged locations. No public exploit has been identified at time of analysis, and a vendor patch is available. | MEDIUM | 6.3 | 0.2% | 32 |
|
| CVE-2026-85640 | Privilege escalation in Zohocorp ManageEngine Endpoint Central below version 11.5.2600.15 permits a locally authenticated low-privilege user to gain elevated access by exploiting an outdated bundled third-party component (CWE-269). The CVSS scope change (S:C) indicates impacts extend beyond the vulnerable component itself, potentially reaching OS-level resources or other managed endpoints under the platform's control. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis. | MEDIUM | 6.3 | 0.2% | 32 |
|
| CVE-2026-77698 | Local privilege escalation in Zohocorp ManageEngine Endpoint Central before version 11.5.2605.01 allows a low-privileged local user to gain elevated access by exploiting improper privilege management (CWE-269) during the agent upgrade process. The CVSS scope change (S:C) confirms that exploitation crosses privilege boundaries beyond the initially compromised context, affecting higher-privileged system components. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis; vendor patch is confirmed available. | MEDIUM | 5.7 | 0.2% | 29 |
|
| CVE-2026-77699 | Local privilege escalation in Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 allows a low-privileged local user to escalate privileges by planting a malicious DLL in an untrusted path from which the application loads libraries. The flaw (CWE-269, Improper Privilege Management) requires local access, user interaction, and high attack complexity to exploit, and carries a scope change indicating impact beyond the vulnerable component itself. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 11.5.2605.01 is confirmed. | MEDIUM | 5.0 | 0.2% | 25 |
|