Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.6

ManageEngine Applications Manager lets low‑privileged users run admin actions

CVE-2026-86681 · published 1 month ago
Summary

Versions of ZohoCorp ManageEngine Applications Manager up to 182200 allow users with limited rights to perform actions that should be reserved for administrators on monitors they don’t own. This could let them change settings or trigger operations they shouldn’t control, potentially affecting service monitoring. Update to the latest version or apply the vendor’s patch to enforce proper permissions.

What to do
  • Update zohocorp manageengine applications manager to version 182300 or later.
Affected software
VendorProductAffected versions
zohocorp manageengine applications manager < 182300
Original advisory text
Broken Access Control vulnerability
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.6 High
Exploitation
1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published23 Sep 2026
Updated31 Oct 2026
First seen23 Sep 2026
Sources
CVE-2026-86681 · NVD
CVE-2026-86681 · MITRE
Track software like this
Free during beta