Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-12591: Zoho M365 Manager Plus lets technicians gain extra rights
CVE-2026-12591 · published today
Summary
Versions of Zoho ManageEngine M365 Manager Plus older than 4818 let a user with technician credentials increase their access beyond what is intended. This could let an attacker run code on the server and take control of the system. Upgrade to version 4818 or later and review technician permissions to limit what they can do.
What to do
- Update zohocorp m365 manager plus to version 4818 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zohocorp | m365 manager plus | < 4818 |
Original advisory text
Privilege Escalation
Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-862Missing Authorization
Timeline
Published12 Nov 2026
Updated12 Nov 2026
First seen12 Nov 2026
Track software like this
Free during beta