Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

ManageEngine Endpoint Central may allow admin-level access

CVE-2026-77697 · published 1 month ago
Summary

Versions of ManageEngine Endpoint Central older than 11.4.2540.23 can be tricked during a file‑extraction step to give an attacker higher system privileges. This could let a malicious user take control of the management server or other connected devices. Upgrade to the latest version as soon as possible to close the gap.

What to do
  • Update zohocorp manageengine endpoint central to version 11.4.2540.23 or later.
Affected software
VendorProductAffected versions
zohocorp manageengine endpoint central < 11.4.2540.23
Original advisory text
Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction
Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-269Improper Privilege Management
Timeline
Published7 Sep 2026
Updated4 Nov 2026
First seen8 Sep 2026
Sources
CVE-2026-77697 · NVD
CVE-2026-77697 · MITRE
Track software like this
Free during beta